summaryrefslogtreecommitdiff
path: root/drivers/char
diff options
context:
space:
mode:
authorJesper Juhl <jj@chaosbits.net>2012-08-16 00:16:33 +0200
committerKent Yoder <key@linux.vnet.ibm.com>2012-08-22 16:23:34 -0500
commitf334ac8da82478b3f8c52e3c01849ad7fe509d5b (patch)
tree4db3665c9b277abc8e41961345518a24bff60790 /drivers/char
parent20328b56cdf8fcc79f28c6c50ad8190fc0779e80 (diff)
tpm: Do not dereference NULL pointer if acpi_os_map_memory() fails.
In drivers/char/tpm/tpm_acpi.c::read_log() we call acpi_os_map_memory(). That call may fail for a number of reasons (invalid address, out of memory etc). If the call fails it returns NULL and we just pass that to memcpy() unconditionally, which will go bad when it tries to dereference the pointer. Unfortunately we just get NULL back, so we can't really tell the user exactely what went wrong, but we can at least avoid crashing and return an error (-EIO seemed more generic and more suitable here than -ENOMEM or something else, so I picked that). Signed-off-by: Jesper Juhl <jj@chaosbits.net> Signed-off-by: Kent Yoder <key@linux.vnet.ibm.com>
Diffstat (limited to 'drivers/char')
-rw-r--r--drivers/char/tpm/tpm_acpi.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/char/tpm/tpm_acpi.c b/drivers/char/tpm/tpm_acpi.c
index a1bb5a182df9..fe3fa9431dc9 100644
--- a/drivers/char/tpm/tpm_acpi.c
+++ b/drivers/char/tpm/tpm_acpi.c
@@ -96,6 +96,11 @@ int read_log(struct tpm_bios_log *log)
log->bios_event_log_end = log->bios_event_log + len;
virt = acpi_os_map_memory(start, len);
+ if (!virt) {
+ kfree(log->bios_event_log);
+ printk("%s: ERROR - Unable to map memory\n", __func__);
+ return -EIO;
+ }
memcpy(log->bios_event_log, virt, len);