lkml.org 
[lkml]   [2005]   [Mar]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] Add TPM hardware enablement driver
    Kylene Hall wrote:
    >>what is the purpose of this pci_dev_get/put? attempting to prevent hotplug or
    >>something?
    >
    >
    > Seems that since there is a refernce to the device in the chip structure
    > and I am making the file private data pointer point to that chip structure
    > this is another reference that must be accounted for. If you remove it
    > with it open and attempt read or write bad things will happen. This isn't
    > really hotpluggable either as the TPM is on the motherboard.

    My point was that there will always be a reference -anyway-, AFAICS.
    There is a pci_dev reference assigned to the pci_driver when the PCI
    driver is loaded, and all uses by the TPM generic code of this pointer
    are -inside- the pci_driver's pci_dev object lifetime.


    >>>+
    >>>+ /* cannot perform a write until the read has cleared
    >>>+ either via tpm_read or a user_read_timer timeout */
    >>>+ while (atomic_read(&chip->data_pending) != 0) {
    >>>+ set_current_state(TASK_UNINTERRUPTIBLE);
    >>>+ schedule_timeout(TPM_TIMEOUT);
    >>
    >
    >>use msleep()
    >
    >
    > addressed in another patch by Nish
    >
    >
    >>>+ /* atomic tpm command send and result receive */
    >>>+ out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE);
    >>
    >>major bug? in_size may be smaller than TPM_BUFSIZE
    >
    >
    > chip->data_buffer is allocated in open and is always this size. The
    > operation needs to be atomic so the big buffer is to cover the size of a
    > potentially larger result. Only reading in_size from the user with
    > copy_from_user

    You output -more- data than you have input.

    AFAICS that's a security bug (data leak), unless you memset the data
    area beforehand.

    Jeff


    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2005-04-06 13:30    [W:0.168 / U:3.224 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site