Merge branch 'for-linus' of git://git.selinuxproject.org/~jmorris/linux-security

* 'for-linus' of git://git.selinuxproject.org/~jmorris/linux-security:
  TPM: Zero buffer after copying to userspace
  TPM: Call tpm_transmit with correct size
  TPM: tpm_nsc: Fix a double free of pdev in cleanup_nsc
  TPM: TCG_ATMEL should depend on HAS_IOPORT

3 files changed, 9 insertions, 3 deletions

diff --git a/drivers/char/tpm/Kconfig b/drivers/char/tpm/Kconfig
index f6595aba4f0f..fa567f1158c2 100644
--- a/drivers/char/tpm/Kconfig
+++ b/drivers/char/tpm/Kconfig
@@ -43,6 +43,7 @@ config TCG_NSC
 
 config TCG_ATMEL
         tristate "Atmel TPM Interface"
+        depends on PPC64 || HAS_IOPORT
         ---help---
           If you have a TPM security chip from Atmel say Yes and it 
           will be accessible from within Linux.  To compile this driver 
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index caf8012ef47c..9ca5c021d0b6 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -383,6 +383,9 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf,
         u32 count, ordinal;
         unsigned long stop;
 
+        if (bufsiz > TPM_BUFSIZE)
+                bufsiz = TPM_BUFSIZE;
+
         count = be32_to_cpu(*((__be32 *) (buf + 2)));
         ordinal = be32_to_cpu(*((__be32 *) (buf + 6)));
         if (count == 0)
@@ -1102,6 +1105,7 @@ ssize_t tpm_read(struct file *file, char __user *buf,
 {
         struct tpm_chip *chip = file->private_data;
         ssize_t ret_size;
+        int rc;
 
         del_singleshot_timer_sync(&chip->user_read_timer);
         flush_work_sync(&chip->work);
@@ -1112,8 +1116,11 @@ ssize_t tpm_read(struct file *file, char __user *buf,
                         ret_size = size;
 
                 mutex_lock(&chip->buffer_mutex);
-                if (copy_to_user(buf, chip->data_buffer, ret_size))
+                rc = copy_to_user(buf, chip->data_buffer, ret_size);
+                memset(chip->data_buffer, 0, ret_size);
+                if (rc)
                         ret_size = -EFAULT;
+
                 mutex_unlock(&chip->buffer_mutex);
         }
 
diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c
index 82facc9104c7..4d2464871ada 100644
--- a/drivers/char/tpm/tpm_nsc.c
+++ b/drivers/char/tpm/tpm_nsc.c
@@ -396,8 +396,6 @@ static void __exit cleanup_nsc(void)
         if (pdev) {
                 tpm_nsc_remove(&pdev->dev);
                 platform_device_unregister(pdev);
-                kfree(pdev);
-                pdev = NULL;
         }
 
         platform_driver_unregister(&nsc_drv);