linux-stable/drivers/char/tpm
Tadeusz Struk c41cb9cb56 tpm: fix race condition in tpm_common_write()
commit 3ab2011ea3 upstream.

There is a race condition in tpm_common_write function allowing
two threads on the same /dev/tpm<N>, or two different applications
on the same /dev/tpmrm<N> to overwrite each other commands/responses.
Fixed this by taking the priv->buffer_mutex early in the function.

Also converted the priv->data_pending from atomic to a regular size_t
type. There is no need for it to be atomic since it is only touched
under the protection of the priv->buffer_mutex.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-07-03 11:24:53 +02:00
..
st33zp24 tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus 2018-03-08 22:41:00 -08:00
Kconfig tpm/tpm_crb: Enable TPM CRB interface for ARM64 2017-04-03 22:46:03 +03:00
Makefile License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tpm-chip.c Do not disable driver and bus shutdown hook when class shutdown hook is set. 2017-08-28 18:02:46 +02:00
tpm-dev-common.c tpm: fix race condition in tpm_common_write() 2018-07-03 11:24:53 +02:00
tpm-dev.c tpm: split out tpm-dev.c into tpm-dev.c and tpm-common-dev.c 2017-04-03 22:46:01 +03:00
tpm-dev.h tpm: fix race condition in tpm_common_write() 2018-07-03 11:24:53 +02:00
tpm-interface.c tpm: add retry logic 2018-04-29 11:33:10 +02:00
tpm-sysfs.c tpm: fix a kernel memory leak in tpm-sysfs.c 2017-07-07 09:49:24 +10:00
tpm.h tpm: add retry logic 2018-04-29 11:33:10 +02:00
tpm1_eventlog.c tpm: add securityfs support for TPM 2.0 firmware event log 2017-02-03 22:03:14 +02:00
tpm2-cmd.c tpm: fix potential buffer overruns caused by bit glitches on the bus 2018-03-08 22:41:00 -08:00
tpm2-space.c tpm: fix use after free in tpm2_load_context() 2018-07-03 11:24:53 +02:00
tpm2_eventlog.c tpm: fix handling of the TPM 2.0 event logs 2017-04-25 00:27:18 +03:00
tpm_acpi.c tpm: add securityfs support for TPM 2.0 firmware event log 2017-02-03 22:03:14 +02:00
tpm_atmel.c tpm/tpm_atmel: remove unnecessary NULL check 2017-06-19 02:36:04 +02:00
tpm_atmel.h tpm: remove tpm_read_index and tpm_write_index from tpm.h 2017-02-03 22:03:14 +02:00
tpm_crb.c tpm: cmd_ready command can be issued only after granting locality 2018-04-29 11:33:10 +02:00
tpm_eventlog.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
tpm_i2c_atmel.c tpm: Factor out common startup code 2016-07-19 17:43:38 +03:00
tpm_i2c_infineon.c tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus 2018-03-08 22:41:00 -08:00
tpm_i2c_nuvoton.c tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus 2018-03-08 22:41:00 -08:00
tpm_ibmvtpm.c tpm: ibmvtpm: simplify crq initialization and document crq format 2017-09-23 21:51:38 -07:00
tpm_ibmvtpm.h
tpm_infineon.c tpm: replace msleep() with usleep_range() in TPM 1.2/2.0 generic drivers 2017-09-23 21:51:00 -07:00
tpm_nsc.c tpm: remove tpm_read_index and tpm_write_index from tpm.h 2017-02-03 22:03:14 +02:00
tpm_of.c tpm: do not suspend/resume if power stays on 2017-07-07 09:49:26 +10:00
tpm_ppi.c ACPI: Switch to use generic guid_t in acpi_evaluate_dsm() 2017-06-07 12:20:49 +02:00
tpm_tis.c tpm: remove unused variables 2018-03-15 10:54:25 +01:00
tpm_tis_core.c tpm: cmd_ready command can be issued only after granting locality 2018-04-29 11:33:10 +02:00
tpm_tis_core.h tpm: delete the TPM_TIS_CLK_ENABLE flag 2018-03-15 10:54:24 +01:00
tpm_tis_spi.c tpm_tis_spi: Use DMA-safe memory for SPI transfers 2018-03-08 22:41:01 -08:00
tpm_vtpm_proxy.c tpm: vtpm_proxy: Prevent userspace from sending driver command 2017-06-13 22:02:09 +03:00
tpmrm-dev.c tpm, tpmrm: Mark tpmrm_write as static 2017-06-13 22:02:08 +03:00
xen-tpmfront.c tpm xen: drop unneeded chip variable 2017-02-14 19:24:33 +02:00