aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorMichael Halcrow <mhalcrow@us.ibm.com>2008-07-25 22:45:00 -0400
committerLinus Torvalds <torvalds@linux-foundation.org>2008-07-26 15:00:04 -0400
commit0147600172b4a5d261165d1aa5ef818d84da1557 (patch)
tree600b372bdde87472043d71716a8cfe638a91373b
parentec288bd37e1925f513db40871bc46115cf7fb733 (diff)
tpm: Use correct data types for sizes in tpm_write() and tpm_read()
Use the correct data types for the size parameters in tpm_write() and tpm_read(). Note that rw_verify_area() makes sure that this bug cannot be exploited to produce a buffer overrun. Signed-off-by: Michael Halcrow <mhalcrow@us.ibm.com> Cc: Marcel Selhorst <tpm@selhorst.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
-rw-r--r--drivers/char/tpm/tpm.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index f354d720b777..ae766d868454 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1028,7 +1028,7 @@ ssize_t tpm_write(struct file *file, const char __user *buf,
1028 size_t size, loff_t *off) 1028 size_t size, loff_t *off)
1029{ 1029{
1030 struct tpm_chip *chip = file->private_data; 1030 struct tpm_chip *chip = file->private_data;
1031 int in_size = size, out_size; 1031 size_t in_size = size, out_size;
1032 1032
1033 /* cannot perform a write until the read has cleared 1033 /* cannot perform a write until the read has cleared
1034 either via tpm_read or a user_read_timer timeout */ 1034 either via tpm_read or a user_read_timer timeout */
@@ -1063,7 +1063,7 @@ ssize_t tpm_read(struct file *file, char __user *buf,
1063 size_t size, loff_t *off) 1063 size_t size, loff_t *off)
1064{ 1064{
1065 struct tpm_chip *chip = file->private_data; 1065 struct tpm_chip *chip = file->private_data;
1066 int ret_size; 1066 ssize_t ret_size;
1067 1067
1068 del_singleshot_timer_sync(&chip->user_read_timer); 1068 del_singleshot_timer_sync(&chip->user_read_timer);
1069 flush_scheduled_work(); 1069 flush_scheduled_work();