On Mon, Oct 05, 2026 at 02:17:23PM +0800, Pei Xiao wrote:
>
>
> 在 2026/10/5 12:16, Jarkko Sakkinen 写道:
> > On Sat, Oct 03, 2026 at 04:27:51PM +0800, Pei Xiao wrote:
> >> tpm_show_ppi_response() stores its return value in an acpi_status,
> >> a typedef of u32. Both error paths of the function (-EINVAL on a
> >> malformed _DSM package, -EFAULT on a non-zero operation return
> >> code) end up as huge positive values when returned as ssize_t, so
> >> user space cannot detect the failure with the usual "ret < 0"
> >> check.
> >
> > I have no idea what you mean by huge value and why that would be
> > a problem, and overall this is disconnected from the code change.
> >
> > Two's complement value is correctly stored in status up until the
> > ssize_t cast, which results the value to be zero-extended, and
> > as a result corrupt the negative values.
> How does the following Git commit message look：
>
> tpm: tpm_ppi: fix zero-extension of negative error codes
>
> tpm_show_ppi_response() keeps its return value in an acpi_status,
> a typedef of u32. The two's complement of the error code is stored
> correctly there, but on return the value is converted to ssize_t and
> zero-extended, so the sign is lost: user space receives 0xFFFFFFEA
> (4294967274) instead of -EINVAL, which breaks the usual "ret < 0" error
> check.
> Declare the variable as ssize_t so that negative values survive the
> conversion.
Works for me. It does not have to be perfect as long as it points out
to the right direction.
> >
> >>
> >> Declare the variable as ssize_t to match the show callback's
> >> return type.
> >>
> >> Fixes: 84b1667dea23 ("ACPI / TPM: replace open-coded _DSM code with helper
> >> functions")
> >> Assisted-by: GLM-5.3
> >> Signed-off-by: Pei Xiao <[email protected]>
> >> ---
> >> drivers/char/tpm/tpm_ppi.c | 2 +-
> >> 1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/drivers/char/tpm/tpm_ppi.c b/drivers/char/tpm/tpm_ppi.c
> >> index c9793a3d986d..949fb7055bea 100644
> >> --- a/drivers/char/tpm/tpm_ppi.c
> >> +++ b/drivers/char/tpm/tpm_ppi.c
> >> @@ -234,7 +234,7 @@ static ssize_t tpm_show_ppi_response(struct device
> >> *dev,
> >> struct device_attribute *attr,
> >> char *buf)
> >> {
> >> - acpi_status status = -EINVAL;
> >> + ssize_t status = -EINVAL;
> >> union acpi_object *obj, *ret_obj;
> >> u64 req, res;
> >> struct tpm_chip *chip = to_tpm_chip(dev);
> >> --
> >> 2.25.1
> >>
> >
> > Br, Jarkko
>
Br, Jarkko
