From patchwork Tue Feb 21 14:45:00 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Enric Balletbo i Serra X-Patchwork-Id: 730609 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3vSNyK1tybz9s7N for ; Wed, 22 Feb 2017 02:02:17 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=sfs-ml-2.v29.ch3.sourceforge.com) by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1cgBxD-0004NG-Q2; Tue, 21 Feb 2017 15:02:11 +0000 Received: from sog-mx-1.v43.ch3.sourceforge.com ([172.29.43.191] helo=mx.sourceforge.net) by sfs-ml-2.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1cgBxC-0004NA-FH for tpmdd-devel@lists.sourceforge.net; Tue, 21 Feb 2017 15:02:10 +0000 Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of collabora.com designates 46.235.227.227 as permitted sender) client-ip=46.235.227.227; envelope-from=enric.balletbo@collabora.com; helo=bhuna.collabora.co.uk; Received: from bhuna.collabora.co.uk ([46.235.227.227]) by sog-mx-1.v43.ch3.sourceforge.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.76) id 1cgBxB-0004F0-5t for tpmdd-devel@lists.sourceforge.net; Tue, 21 Feb 2017 15:02:10 +0000 Received: from [127.0.0.1] (localhost [127.0.0.1]) (Authenticated sender: eballetbo) with ESMTPSA id CC0BF26A68A From: Enric Balletbo i Serra To: Peter Huewe , Marcel Selhorst Date: Tue, 21 Feb 2017 15:45:00 +0100 Message-Id: <20170221144500.502-2-enric.balletbo@collabora.com> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20170221144500.502-1-enric.balletbo@collabora.com> References: <20170221144500.502-1-enric.balletbo@collabora.com> X-Spam-Score: -1.5 (-) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for sender-domain -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at http://www.dnswl.org/, no trust [46.235.227.227 listed in list.dnswl.org] -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record 0.0 UNPARSEABLE_RELAY Informational: message has unparseable relay lines X-Headers-End: 1cgBxB-0004F0-5t Cc: apronin@google.com, tpmdd-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org, Bryan Freed Subject: [tpmdd-devel] [PATCH 2/2] tpm: Do not assume an i2c adapter preserves the msg len X-BeenThere: tpmdd-devel@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: Tpm Device Driver maintainance List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: tpmdd-devel-bounces@lists.sourceforge.net From: Bryan Freed Prevent a possible infinite loop by using a local variable to advance len down to 0. This is safer than trusting the I2C and adapter drivers to preserve msg2.len. Signed-off-by: Bryan Freed Signed-off-by: Enric Balletbo i Serra --- drivers/char/tpm/tpm_i2c_infineon.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c index f04c6b7..fbee05b 100644 --- a/drivers/char/tpm/tpm_i2c_infineon.c +++ b/drivers/char/tpm/tpm_i2c_infineon.c @@ -107,11 +107,10 @@ static int iic_tpm_read(u8 addr, u8 *buffer, size_t len) .len = len, .buf = buffer }; - struct i2c_msg msgs[] = {msg1, msg2}; int rc = 0; int count; - int adapterlimit = len; + unsigned int adapterlimit = len; /* Lock the adapter for the duration of the whole sequence. */ if (!tpm_dev.client->adapter->algo->master_xfer) @@ -137,18 +136,19 @@ static int iic_tpm_read(u8 addr, u8 *buffer, size_t len) * retrieving the data */ for (count = 0; count < MAX_COUNT; count++) { + unsigned int msglen = msg2.len = + min_t(unsigned int, adapterlimit, len); usleep_range(SLEEP_DURATION_LOW, SLEEP_DURATION_HI); - msg2.len = min(adapterlimit, len); rc = __i2c_transfer(tpm_dev.client->adapter, &msg2, 1); if (rc > 0) { /* Since len is unsigned, make doubly sure we * do not underflow it. */ - if (msg2.len > len) + if (msglen > len) len = 0; else - len -= msg2.len; - msg2.buf += msg2.len; + len -= msglen; + msg2.buf += msglen; break; } /* If the I2C adapter rejected the request, @@ -156,7 +156,7 @@ static int iic_tpm_read(u8 addr, u8 *buffer, size_t len) */ if (rc == -EINVAL) { adapterlimit = (adapterlimit + 1) / 2; - adapterlimit = max(adapterlimit, 32); + adapterlimit = max(adapterlimit, 32U); } } if (rc <= 0)