Messages in this thread | | | Date | Wed, 8 Aug 2012 13:07:51 -0500 | From | Kent Yoder <> | Subject | Re: [PATCH] tpm: Do not dereference NULL pointer if acpi_os_map_memory() fails. |
| |
On Tue, Aug 07, 2012 at 10:50:56PM +0200, Jesper Juhl wrote: > In drivers/char/tpm/tpm_bios.c::read_log() we call > acpi_os_map_memory(). That call may fail for a number of reasons > (invallid address, out of memory etc). If the call fails it returns > NULL and we just pass that to memcpy() unconditionally, which will go > bad when it tries to dereference the pointer. > > Unfortunately we just get NULL back, so we can't really tell the user > exactely what went wrong, but we can at least avoid crashing and > return an error (-EIO seemed more generic and more suitable here than > -ENOMEM or something else, so I picked that).
Thanks Jesper. I'd made some updates to tpm_bios.c recently but this should still apply. I'll let you know if not.
Kent
> > Signed-off-by: Jesper Juhl <jj@chaosbits.net> > --- > drivers/char/tpm/tpm_bios.c | 5 +++++ > 1 file changed, 5 insertions(+) > > Compile tested only. > > diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c > index 0636520..0c5c274 100644 > --- a/drivers/char/tpm/tpm_bios.c > +++ b/drivers/char/tpm/tpm_bios.c > @@ -410,6 +410,11 @@ static int read_log(struct tpm_bios_log *log) > log->bios_event_log_end = log->bios_event_log + len; > > virt = acpi_os_map_memory(start, len); > + if (!virt) { > + printk("%s: ERROR - Unable to map memory\n", > + __func__); > + return -EIO; > + } > > memcpy(log->bios_event_log, virt, len); > > -- > 1.7.11.4 > > > -- > Jesper Juhl <jj@chaosbits.net> http://www.chaosbits.net/ > Don't top-post http://www.catb.org/jargon/html/T/top-post.html > Plain text mails only, please. >
| |