Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1263076 > unrolled thread

[PATCH 0/3] Fixes for v4.4-rc1

Back to article view | Back to linux.kernel

Contents

  [PATCH 0/3] Fixes for v4.4-rc1 Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2015-11-05 11:30 +0100
    [PATCH 1/3] TPM: Avoid reference to potentially freed memory Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> - 2015-11-05 11:30 +0100

#1263076 — [PATCH 0/3] Fixes for v4.4-rc1

Critical bug fixes for v4.4-rc1.

Christophe JAILLET (1):
  TPM: Avoid reference to potentially freed memory

Jarkko Sakkinen (2):
  TPM: revert the list handling logic fixed in 398a1e7
  tpm: fix missing migratable flag in sealing functionality for TPM2

 drivers/char/tpm/tpm-chip.c |  2 +-
 drivers/char/tpm/tpm2-cmd.c | 15 ++++++++++-----
 drivers/char/tpm/tpm_of.c   |  3 ++-
 3 files changed, 13 insertions(+), 7 deletions(-)

-- 
2.5.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1263078 — [PATCH 1/3] TPM: Avoid reference to potentially freed memory

From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

Reference to the 'np' node is dropped before dereferencing the 'sizep' and
'basep' pointers, which could by then point to junk if the node has been
freed.

Refactor code to call 'of_node_put' later.

Fixes: c5df39262dd5 ("drivers/char/tpm: Add securityfs support for event log")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
---
 drivers/char/tpm/tpm_of.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/char/tpm/tpm_of.c b/drivers/char/tpm/tpm_of.c
index 1141456..570f30c 100644
--- a/drivers/char/tpm/tpm_of.c
+++ b/drivers/char/tpm/tpm_of.c
@@ -53,17 +53,18 @@ int read_log(struct tpm_bios_log *log)
 		goto cleanup_eio;
 	}
 
-	of_node_put(np);
 	log->bios_event_log = kmalloc(*sizep, GFP_KERNEL);
 	if (!log->bios_event_log) {
 		pr_err("%s: ERROR - Not enough memory for BIOS measurements\n",
 		       __func__);
+		of_node_put(np);
 		return -ENOMEM;
 	}
 
 	log->bios_event_log_end = log->bios_event_log + *sizep;
 
 	memcpy(log->bios_event_log, __va(*basep), *sizep);
+	of_node_put(np);
 
 	return 0;
 
-- 
2.5.0

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web