Skip to contentSkip to conversation

char: tpm: fix potential null pointer dereference

PATCH In review Gustavo A. R. Silva 2 participants 4 messages May 30, 2017 – May 31, 2017 TPM device driver

lore
Share & tools
lore

Gustavo A. R. Silva

author
#0 lore raw

PATCH 1/1 char: tpm: fix potential null pointer dereference

NULL check at line 376: if (!chip) {, implies chip might be NULL. Function dev_get_drvdata() dereference pointer chip. Move pointer tmp_dev assignment after the NULL check.

Addresses-Coverity-ID: 1397648

Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/char/tpm/st33zp24/st33zp24.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
drivers/char/tpm/st33zp24/st33zp24.c +2 -1
index 4d1dc8b..f45e8c7 100644
@@ -367,7 +367,7 @@ static irqreturn_t tpm_ioserirq_handler(int irq, void *dev_id)
 static int st33zp24_send(struct tpm_chip *chip, unsigned char *buf,
 			 size_t len)
 {
-	struct st33zp24_dev *tpm_dev = dev_get_drvdata(&chip->dev);
+	struct st33zp24_dev *tpm_dev;
 	u32 status, i, size, ordinal;
 	int burstcnt = 0;
 	int ret;

@@ -382,6 +382,7 @@ static int st33zp24_send(struct tpm_chip *chip, unsigned char *buf,
 	if (ret < 0)
 		return ret;
 
+	tpm_dev = dev_get_drvdata(&chip->dev);
 	status = st33zp24_status(chip);
 	if ((status & TPM_STS_COMMAND_READY) == 0) {
 		st33zp24_cancel(chip);
Signature · 1 line
2.5.0
#1 lore raw
Quoted 3 lines · Gustavo A. R. Silva

NULL check at line 376: if (!chip) {, implies chip might be NULL. Function dev_get_drvdata() dereference pointer chip. Move pointer tmp_dev assignment after the NULL check.

chip cannot be null in st33zp24_send, please remove the bogus if instead.

Jason

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot

author
#2 lore raw

Hi Jason,

Quoting Jason Gunthorpe <[email protected]>:

Quoted 8 lines · Gustavo A. R. Silva
Quoted 3 lines

NULL check at line 376: if (!chip) {, implies chip might be NULL. Function dev_get_drvdata() dereference pointer chip. Move pointer tmp_dev assignment after the NULL check.

chip cannot be null in st33zp24_send, please remove the bogus if instead.

I get it.

Thanks for clarifying.
--
Gustavo A. R. Silva

author
#3 lore raw

PATCH 1/1 char: tpm: remove unnecessary code

Remove unnecessary code.
Pointer chip cannot be NULL in st33zp24_send().

Addresses-Coverity-ID: 1397648

Cc Jason Gunthorpe <[email protected]>
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/char/tpm/st33zp24/st33zp24.c | 2 --
 1 file changed, 2 deletions(-)
drivers/char/tpm/st33zp24/st33zp24.c +0 -2
index 4d1dc8b..ca74c24 100644
@@ -373,8 +373,6 @@ static int st33zp24_send(struct tpm_chip *chip, unsigned char *buf,
 	int ret;
 	u8 data;
 
-	if (!chip)
-		return -EBUSY;
 	if (len < TPM_HEADER_SIZE)
 		return -EBUSY;
Signature · 1 line
2.5.0