Peter Huewe 39a088528e tpm: Propagate error from tpm_transmit to fix a timeout hang ... commit abce9ac292 upstream. tpm_write calls tpm_transmit without checking the return value and assigns the return value unconditionally to chip->pending_data, even if it's an error value. This causes three bugs. So if we write to /dev/tpm0 with a tpm_param_size bigger than TPM_BUFSIZE=0x1000 (e.g. 0x100a) and a bufsize also bigger than TPM_BUFSIZE (e.g. 0x100a) tpm_transmit returns -E2BIG which is assigned to chip->pending_data as -7, but tpm_write returns that TPM_BUFSIZE bytes have been successfully been written to the TPM, altough this is not true (bug #1). As we did write more than than TPM_BUFSIZE bytes but tpm_write reports that only TPM_BUFSIZE bytes have been written the vfs tries to write the remaining bytes (in this case 10 bytes) to the tpm device driver via tpm_write which then blocks at /* cannot perform a write until the read has cleared either via tpm_read or a user_read_timer timeout */ while (atomic_read(&chip->data_pending) != 0) msleep(TPM_TIMEOUT); for 60 seconds, since data_pending is -7 and nobody is able to read it (since tpm_read luckily checks if data_pending is greater than 0) (#bug 2). After that the remaining bytes are written to the TPM which are interpreted by the tpm as a normal command. (bug #3) So if the last bytes of the command stream happen to be a e.g. tpm_force_clear this gets accidentally sent to the TPM. This patch fixes all three bugs, by propagating the error code of tpm_write and returning -E2BIG if the input buffer is too big, since the response from the tpm for a truncated value is bogus anyway. Moreover it returns -EBUSY to userspace if there is a response ready to be read. Signed-off-by: Peter Huewe <peter.huewe@infineon.com> Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2012-10-21 09:17:12 -07:00
..
Kconfig	Update broken web addresses in the kernel.	2010-10-18 11:03:14 +02:00
Makefile
tpm.c	tpm: Propagate error from tpm_transmit to fix a timeout hang	2012-10-21 09:17:12 -07:00
tpm.h	Revert "tpm_tis: Use timeouts returned from TPM"	2011-02-20 10:03:12 -08:00
tpm_atmel.c	platform driver: fix incorrect use of 'platform_bus_type' with 'struct device_driver'	2009-03-24 16:38:25 -07:00
tpm_atmel.h
tpm_bios.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
tpm_infineon.c	Update broken web addresses in the kernel.	2010-10-18 11:03:14 +02:00
tpm_nsc.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
tpm_tis.c	Revert "tpm_tis: Use timeouts returned from TPM"	2011-02-20 10:03:12 -08:00