Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4d7127da authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 

Pull TPM bugfixes from James Morris.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  tpm: Propagate error from tpm_transmit to fix a timeout hang
  driver/char/tpm: fix regression causesd by ppi
parents a3920a6e 59b69ac2

drivers/char/tpm/tpm.c

+16 −8
Original line number Diff line number Diff line
@@ -1182,17 +1182,20 @@ ssize_t tpm_write(struct file *file, const char __user *buf, 
		  size_t size, loff_t *off)

{

	struct tpm_chip *chip = file->private_data;

	size_t in_size = size, out_size;

	size_t in_size = size;

	ssize_t out_size;



	/* cannot perform a write until the read has cleared

	   either via tpm_read or a user_read_timer timeout */

	while (atomic_read(&chip->data_pending) != 0)

		msleep(TPM_TIMEOUT);



	mutex_lock(&chip->buffer_mutex);

	   either via tpm_read or a user_read_timer timeout.

	   This also prevents splitted buffered writes from blocking here.

	*/

	if (atomic_read(&chip->data_pending) != 0)

		return -EBUSY;



	if (in_size > TPM_BUFSIZE)

		in_size = TPM_BUFSIZE;

		return -E2BIG;



	mutex_lock(&chip->buffer_mutex);



	if (copy_from_user

	    (chip->data_buffer, (void __user *) buf, in_size)) {
@@ -1202,6 +1205,10 @@ ssize_t tpm_write(struct file *file, const char __user *buf, 


	/* atomic tpm command send and result receive */

	out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);

	if (out_size < 0) {

		mutex_unlock(&chip->buffer_mutex);

		return out_size;

	}



	atomic_set(&chip->data_pending, out_size);

	mutex_unlock(&chip->buffer_mutex);
@@ -1259,6 +1266,7 @@ void tpm_remove_hardware(struct device *dev) 


	misc_deregister(&chip->vendor.miscdev);

	sysfs_remove_group(&dev->kobj, chip->vendor.attr_group);

	tpm_remove_ppi(&dev->kobj);

	tpm_bios_log_teardown(chip->bios_dir);



	/* write it this way to be explicit (chip->dev == dev) */
@@ -1476,7 +1484,7 @@ struct tpm_chip *tpm_register_hardware(struct device *dev, 
		goto put_device;

	}



	if (sys_add_ppi(&dev->kobj)) {

	if (tpm_add_ppi(&dev->kobj)) {

		misc_deregister(&chip->vendor.miscdev);

		goto put_device;

	}

drivers/char/tpm/tpm.h

+7 −2
Original line number Diff line number Diff line
@@ -329,10 +329,15 @@ extern int wait_for_tpm_stat(struct tpm_chip *, u8, unsigned long, 
			     wait_queue_head_t *);



#ifdef CONFIG_ACPI

extern ssize_t sys_add_ppi(struct kobject *parent);

extern int tpm_add_ppi(struct kobject *);

extern void tpm_remove_ppi(struct kobject *);

#else

static inline ssize_t sys_add_ppi(struct kobject *parent)

static inline int tpm_add_ppi(struct kobject *parent)

{

	return 0;

}



static inline void tpm_remove_ppi(struct kobject *parent)

{

}

#endif

drivers/char/tpm/tpm_ppi.c

+10 −8
Original line number Diff line number Diff line
@@ -444,18 +444,20 @@ static struct attribute *ppi_attrs[] = { 
	&dev_attr_vs_operations.attr, NULL,

};

static struct attribute_group ppi_attr_grp = {

	.name = "ppi",

	.attrs = ppi_attrs

};



ssize_t sys_add_ppi(struct kobject *parent)

int tpm_add_ppi(struct kobject *parent)

{

	struct kobject *ppi;

	ppi = kobject_create_and_add("ppi", parent);

	if (sysfs_create_group(ppi, &ppi_attr_grp))

		return -EFAULT;

	else

		return 0;

	return sysfs_create_group(parent, &ppi_attr_grp);

}

EXPORT_SYMBOL_GPL(tpm_add_ppi);



void tpm_remove_ppi(struct kobject *parent)

{

	sysfs_remove_group(parent, &ppi_attr_grp);

}

EXPORT_SYMBOL_GPL(sys_add_ppi);

EXPORT_SYMBOL_GPL(tpm_remove_ppi);



MODULE_LICENSE("GPL");