On Thu, Aug 16, 2012 at 12:16:33AM +0200, Jesper Juhl wrote:
> In drivers/char/tpm/tpm_acpi.c::read_log() we call
> acpi_os_map_memory(). That call may fail for a number of reasons
> (invalid address, out of memory etc). If the call fails it returns
> NULL and we just pass that to memcpy() uncondit
In drivers/char/tpm/tpm_acpi.c::read_log() we call
acpi_os_map_memory(). That call may fail for a number of reasons
(invalid address, out of memory etc). If the call fails it returns
NULL and we just pass that to memcpy() unconditionally, which will go
bad when it tries to dereference the pointer.
On Wed, 15 Aug 2012, Kent Yoder wrote:
> Hi Jesper,
>
> > > Unfortunately we just get NULL back, so we can't really tell the user
> > > exactely what went wrong, but we can at least avoid crashing and
> > > return an error (-EIO seemed more generic and more suitable here than
> > > -ENOMEM or som
Hi Jesper,
> > Unfortunately we just get NULL back, so we can't really tell the user
> > exactely what went wrong, but we can at least avoid crashing and
> > return an error (-EIO seemed more generic and more suitable here than
> > -ENOMEM or something else, so I picked that).
>
> Thanks Jesper.
On Tue, Aug 07, 2012 at 10:50:56PM +0200, Jesper Juhl wrote:
> In drivers/char/tpm/tpm_bios.c::read_log() we call
> acpi_os_map_memory(). That call may fail for a number of reasons
> (invallid address, out of memory etc). If the call fails it returns
> NULL and we just pass that to memcpy() uncondi
In drivers/char/tpm/tpm_bios.c::read_log() we call
acpi_os_map_memory(). That call may fail for a number of reasons
(invallid address, out of memory etc). If the call fails it returns
NULL and we just pass that to memcpy() unconditionally, which will go
bad when it tries to dereference the pointer.
6 matches
Mail list logo