linux-kernel - [PATCH] tpm: tpm_i2c_infineon: Fix locality leak on get

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20251226102339.45054-1-alperyasinak1@gmail.com>
Date: Fri, 26 Dec 2025 13:23:38 +0300
From: Alper Ak <alperyasinak1@...il.com>
To: peterhuewe@....de,
	jarkko@...nel.org
Cc: Alper Ak <alperyasinak1@...il.com>,
	Jason Gunthorpe <jgg@...pe.ca>,
	Bryan Freed <bfreed@...omium.org>,
	Andi Shyti <andi.shyti@...il.com>,
	Kent Yoder <key@...ux.vnet.ibm.com>,
	Marcel Selhorst <tpmdd@...horst.net>,
	linux-integrity@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] tpm: tpm_i2c_infineon: Fix locality leak on get_burstcount() failure

get_burstcount() can return -EBUSY on timeout. When this happens, the
function returns directly without releasing the locality that was
acquired at the beginning of tpm_tis_i2c_send().

Use goto out_err to ensure proper cleanup when get_burstcount() fails.

Fixes: aad628c1d91a ("char/tpm: Add new driver for Infineon I2C TIS TPM")
Signed-off-by: Alper Ak <alperyasinak1@...il.com>
---
 drivers/char/tpm/tpm_i2c_infineon.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c
index bdf1f329a679..8b7d32de0b2e 100644
--- a/drivers/char/tpm/tpm_i2c_infineon.c
+++ b/drivers/char/tpm/tpm_i2c_infineon.c
@@ -544,8 +544,10 @@ static int tpm_tis_i2c_send(struct tpm_chip *chip, u8 *buf, size_t bufsiz,
 		burstcnt = get_burstcount(chip);
 
 		/* burstcnt < 0 = TPM is busy */
-		if (burstcnt < 0)
-			return burstcnt;
+		if (burstcnt < 0) {
+			rc = burstcnt;
+			goto out_err;
+		}
 
 		if (burstcnt > (len - 1 - count))
 			burstcnt = len - 1 - count;
-- 
2.43.0