diff options
| author |   David S. Miller <davem@davemloft.net> | 2018-03-06 00:53:44 -0500 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-03-06 01:20:46 -0500 |
| commit | 0f3e9c97eb5a97972b0c0076a5cc01bb142f8e70 (patch) | |
| tree | 439c89ea3c87496c23e167148f2cdbefb6e82b30 /drivers/char/tpm/tpm2-cmd.c | |
| parent | Merge branch 'mvpp2-jumbo-frames-support' (diff) | |
| parent | Merge tag 'please-pull-ia64_misc' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux (diff) | |
| download | linux-dev-0f3e9c97eb5a97972b0c0076a5cc01bb142f8e70.tar.xz linux-dev-0f3e9c97eb5a97972b0c0076a5cc01bb142f8e70.zip | |
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
All of the conflicts were cases of overlapping changes.
In net/core/devlink.c, we have to make care that the
resouce size_params have become a struct member rather
than a pointer to such an object.
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/char/tpm/tpm2-cmd.c')
| -rw-r--r-- | drivers/char/tpm/tpm2-cmd.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index c17e75348a99..a700f8f9ead7 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -683,6 +683,10 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, if (!rc) { data_len = be16_to_cpup( (__be16 *) &buf.data[TPM_HEADER_SIZE + 4]); + if (data_len < MIN_KEY_SIZE || data_len > MAX_KEY_SIZE + 1) { + rc = -EFAULT; + goto out; + } rlength = be32_to_cpu(((struct tpm2_cmd *)&buf) ->header.out.length); |