diff options
| author | Ruoyu Wang <ruoyuw560@gmail.com> | 2026-08-13 23:30:32 +0800 |
|---|---|---|
| committer | Jarkko Sakkinen <jarkko@kernel.org> | 2026-08-25 18:13:34 +0300 |
| commit | 264216889d39df509b9c8045df53529480b0b718 (patch) | |
| tree | 5a98c8752a6e4108c6e0a4b07d5983abe7f13ecd /drivers/char | |
| parent | 8b92687708f5ef980de01c2042dbd76d11f78547 (diff) | |
tpm: st33zp24: Validate locality read result
check_locality() treats every nonzero transport return as success. SPI
errors remain negative, while the I2C path can convert a negative write
error through its byte-sized status variable. Either result is nonzero
even though the TPM_ACCESS byte can remain unwritten, so indeterminate
ACTIVE_LOCALITY and VALID bits can falsely report an active locality.
Require recv() to return exactly the requested byte before examining
TPM_ACCESS. Transport errors and short reads now report an inactive
locality, while successful reads retain the existing behavior.
This issue was found by a static analysis checker and confirmed by manual
source review.
Fixes: 251a7b08213a ("TPM: STMicroelectronics ST33 I2C KERNEL 3.x")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Link: https://lore.kernel.org/r/20260813153032.3951878-2-ruoyuw560@gmail.com
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/tpm/st33zp24/st33zp24.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/char/tpm/st33zp24/st33zp24.c b/drivers/char/tpm/st33zp24/st33zp24.c index 168df7c8d13b..c15a9b7aaff8 100644 --- a/drivers/char/tpm/st33zp24/st33zp24.c +++ b/drivers/char/tpm/st33zp24/st33zp24.c @@ -106,10 +106,10 @@ static bool check_locality(struct tpm_chip *chip) { struct st33zp24_dev *tpm_dev = dev_get_drvdata(&chip->dev); u8 data; - u8 status; + int status; status = tpm_dev->ops->recv(tpm_dev->phy_id, TPM_ACCESS, &data, 1); - if (status && (data & + if (status == 1 && (data & (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) == (TPM_ACCESS_ACTIVE_LOCALITY | TPM_ACCESS_VALID)) return true; |