• Kent Yoder's avatar
    tpm: fix double write race and tpm_release free issue · dd7da132
    Kent Yoder authored
    Moved the atomic_set of the data_pending variable until after the
    tpm_read has completed processing. The existing code had a window of
    time where a second write to the driver could clobber the tpm command
    buffer.
    
    Also fixed an issue where if close was called on the tpm device before a
    read completed, the tpm command buffer would be returned to the OS,
    which could contain sensitive information.
    Signed-off-by: default avatarKent Yoder <key@linux.vnet.ibm.com>
    dd7da132
tpm.c 35.5 KB