tpm_tis: Check return values from get_burstcount.

If the TPM we're connecting to uses a static burst count, it will report a burst count of zero throughout the response read. However, get_burstcount assumes that a response of zero indicates that the TPM is not ready to receive more data. In this case, it returns a negative error code, which is passed on to tpm_tis_{write,read}_bytes as a u16, causing them to read/write far too many bytes.

This patch checks for negative return codes and bails out from recv_data and tpm_tis_send_data.

Fixes 1107d065fdf1 (tpm_tis: Introduce intermediate layer for TPM access)

Signed-off-by Josh Zimmerman <[email protected]>

---
Changelog v4:
- Add short description to Fixes tag line.
- Remove some unnecessary information in dev_err statements.
Changelog v3:
- Add signed-off-by.
Changelog v2:
- Fix typo (rc->burstcnt)

---
 drivers/char/tpm/tpm_tis_core.c | 9 +++++++++
 1 file changed, 9 insertions(+)

drivers/char/tpm/tpm_tis_core.c +0 -0

index e3bf31b..0f2c233 100644

drivers/char/tpm/tpm_tis_core.c +4 -0

+			dev_err(&chip->dev, "Unable to read burstcount\n");
+			rc = burstcnt;
+			goto out_err;
+		}
 		rc = tpm_tis_write_bytes(priv, TPM_DATA_FIFO(priv->locality),
 					 burstcnt, buf + count);

if (rc < 0)
--
2.8.0.rc3.226.g39d4020

Quoted 2 lines

If the TPM we're connecting to uses a static burst count, it will report

a burst

Quoted 1 line

count of zero throughout the response read. However, get_burstcount

assumes

Quoted 1 line

that a response of zero indicates that the TPM is not ready to receive

more

Quoted 1 line

data. In this case, it returns a negative error code, which is passed on

to

Quoted 1 line

tpm_tis_{write,read}_bytes as a u16, causing them to read/write far too

many

Quoted 3 lines

bytes.

This patch checks for negative return codes and bails out from recv_data

and

Quoted 3 lines

tpm_tis_send_data.

Fixes 1107d065fdf1 (tpm_tis: Introduce intermediate layer for TPM

access)

drivers/char/tpm/tpm_tis_

Quoted 16 lines

Signed-off-by Josh Zimmerman <[email protected]>

---
Changelog v4:
- Add short description to Fixes tag line.
- Remove some unnecessary information in dev_err statements.
Changelog v3:
- Add signed-off-by.
Changelog v2:
- Fix typo (rc->burstcnt)

---
 drivers/char/tpm/tpm_tis_core.c | 9 +++++++++
 1 file changed, 9 insertions(+)

drivers/char/tpm/tpm_tis_ renamed from drivers/char/tpm/tpm_tis_core.c +0 -0

core.c

drivers/char/tpm/tpm_tis_core.c static int recv_data(struct tpm_chip *chip, u8 *buf, · line 190

Quoted 9 lines

index e3bf31b..0f2c233 100644

drivers/char/tpm/tpm_tis_core.c +1 -0

@@ -186,6 +186,10 @@ static int recv_data(struct tpm_chip *chip, u8 *buf,
 size_t count)
                               chip->timeout_c,
                               &priv->read_queue, true) == 0) {
              burstcnt = min_t(int, get_burstcount(chip), count - size);
+             if (burstcnt < 0) {

It is much more readable to directly check get_burstcount return value, 'count - size' is protected be above condition to not reach negative value.
burstcnt = get_burstcount(chip)
if (brustcnt < 0) ...

drivers/char/tpm/tpm_tis_core.c static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)

Quoted 5 lines

drivers/char/tpm/tpm_tis_core.c +3 -0

+                     dev_err(&chip->dev, "Unable to read burstcount\n");
+                     return burstcnt;
+             }
 
              rc = tpm_tis_read_bytes(priv,

TPM_DATA_FIFO(priv->locality),

drivers/char/tpm/tpm_tis_core.c static int tpm_tis_send_data(struct tpm_chip *chip,

Quoted 2 lines

                                      burstcnt, buf + size);

drivers/char/tpm/tpm_tis_core.c +0 -0

@@ -272,6 +276,11 @@ static int tpm_tis_send_data(struct tpm_chip *chip,

u8

drivers/char/tpm/tpm_tis_core.c static int tpm_tis_send_data(struct tpm_chip *chip, u8 *buf, size_t len)

Quoted 4 lines

drivers/char/tpm/tpm_tis_core.c +0 -0

 *buf, size_t len)
 
      while (count < len - 1) {
              burstcnt = min_t(int, get_burstcount(chip), len - count -

1);

drivers/char/tpm/tpm_tis_core.c static int tpm_tis_send_data(struct tpm_chip *chip, · line 280

Quoted 1 line

drivers/char/tpm/tpm_tis_core.c +1 -0

+             if (burstcnt < 0) {

Same here

drivers/char/tpm/tpm_tis_core.c static int tpm_tis_send_data(struct tpm_chip *chip, u8 *buf, size_t len)

Quoted 5 lines

drivers/char/tpm/tpm_tis_core.c +4 -0

+                     dev_err(&chip->dev, "Unable to read burstcount\n");
+                     rc = burstcnt;
+                     goto out_err;
+             }
              rc = tpm_tis_write_bytes(priv,

TPM_DATA_FIFO(priv->locality),

Quoted 4 lines

drivers/char/tpm/tpm_tis_core.c +0 -0

                                       burstcnt, buf + count);

              if (rc < 0)

--
2.8.0.rc3.226.g39d4020

Thanks
Tomas