linux-kernel - [PATCH] tpm: Do not dereference NULL pointer if acpi_os_map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 7 Aug 2012 22:50:56 +0200 (CEST)
From:	Jesper Juhl <jj@...osbits.net>
To:	linux-kernel@...r.kernel.org
cc:	tpmdd-devel@...ts.sourceforge.net, Sirrix AG <tpmdd@...rix.com>,
	Marcel Selhorst <tpmdd@...horst.net>,
	Rajiv Andrade <mail@...jiv.net>,
	Kent Yoder <key@...ux.vnet.ibm.com>,
	Seiji Munetoh <munetoh@...ibm.com>,
	Stefan Berger <stefanb@...ibm.com>,
	Reiner Sailer <sailer@...son.ibm.com>,
	Kylene Hall <kjhall@...ibm.com>
Subject: [PATCH] tpm: Do not dereference NULL pointer if acpi_os_map_memory()
 fails.

In drivers/char/tpm/tpm_bios.c::read_log() we call
acpi_os_map_memory(). That call may fail for a number of reasons
(invallid address, out of memory etc). If the call fails it returns
NULL and we just pass that to memcpy() unconditionally, which will go
bad when it tries to dereference the pointer.

Unfortunately we just get NULL back, so we can't really tell the user
exactely what went wrong, but we can at least avoid crashing and
return an error (-EIO seemed more generic and more suitable here than
-ENOMEM or something else, so I picked that).

Signed-off-by: Jesper Juhl <jj@...osbits.net>
---
 drivers/char/tpm/tpm_bios.c | 5 +++++
 1 file changed, 5 insertions(+)

  Compile tested only.

diff --git a/drivers/char/tpm/tpm_bios.c b/drivers/char/tpm/tpm_bios.c
index 0636520..0c5c274 100644
--- a/drivers/char/tpm/tpm_bios.c
+++ b/drivers/char/tpm/tpm_bios.c
@@ -410,6 +410,11 @@ static int read_log(struct tpm_bios_log *log)
 	log->bios_event_log_end = log->bios_event_log + len;
 
 	virt = acpi_os_map_memory(start, len);
+	if (!virt) {
+		printk("%s: ERROR - Unable to map memory\n",
+			__func__);
+		return -EIO;
+	}
 
 	memcpy(log->bios_event_log, virt, len);
 
-- 
1.7.11.4


-- 
Jesper Juhl <jj@...osbits.net>       http://www.chaosbits.net/
Don't top-post http://www.catb.org/jargon/html/T/top-post.html
Plain text mails only, please.

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/