tpm: Use correct data types for sizes in tpm_write() and tpm_read()
Use the correct data types for the size parameters in tpm_write() and tpm_read(). Note that rw_verify_area() makes sure that this bug cannot be exploited to produce a buffer overrun. Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com> Cc: Marcel Selhorst <tpm@selhorst.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This commit is contained in:
parent
ec288bd37e
commit
0147600172
@ -1028,7 +1028,7 @@ ssize_t tpm_write(struct file *file, const char __user *buf,
|
|||||||
size_t size, loff_t *off)
|
size_t size, loff_t *off)
|
||||||
{
|
{
|
||||||
struct tpm_chip *chip = file->private_data;
|
struct tpm_chip *chip = file->private_data;
|
||||||
int in_size = size, out_size;
|
size_t in_size = size, out_size;
|
||||||
|
|
||||||
/* cannot perform a write until the read has cleared
|
/* cannot perform a write until the read has cleared
|
||||||
either via tpm_read or a user_read_timer timeout */
|
either via tpm_read or a user_read_timer timeout */
|
||||||
@ -1063,7 +1063,7 @@ ssize_t tpm_read(struct file *file, char __user *buf,
|
|||||||
size_t size, loff_t *off)
|
size_t size, loff_t *off)
|
||||||
{
|
{
|
||||||
struct tpm_chip *chip = file->private_data;
|
struct tpm_chip *chip = file->private_data;
|
||||||
int ret_size;
|
ssize_t ret_size;
|
||||||
|
|
||||||
del_singleshot_timer_sync(&chip->user_read_timer);
|
del_singleshot_timer_sync(&chip->user_read_timer);
|
||||||
flush_scheduled_work();
|
flush_scheduled_work();
|
||||||
|
Loading…
Reference in New Issue
Block a user