diff options
| author | Sean Paul <seanpaul@chromium.org> | 2018-03-30 12:35:45 -0400 |
|---|---|---|
| committer | Sean Paul <seanpaul@chromium.org> | 2018-03-30 12:35:45 -0400 |
| commit | 83fd26c3f32afe38bb2ab8cc00e313ec5c2edbce (patch) | |
| tree | b2d2719c998bc2bcba99f2ecf2d164ee9b7ad75a /drivers/char/tpm/tpm-interface.c | |
| parent | 4165791d29f64e01860a064f3c649447dbac41c3 (diff) | |
| parent | 694f54f680f7fd8e9561928fbfc537d9afbc3d79 (diff) | |
Merge airlied/drm-next into drm-misc-next
Backmerging to pick up a fix from drm-misc-next-fixes.
Signed-off-by: Sean Paul <seanpaul@chromium.org>
Diffstat (limited to 'drivers/char/tpm/tpm-interface.c')
| -rw-r--r-- | drivers/char/tpm/tpm-interface.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index 76df4fbcf089..9e80a953d693 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -1190,6 +1190,10 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max) break; recd = be32_to_cpu(tpm_cmd.params.getrandom_out.rng_data_len); + if (recd > num_bytes) { + total = -EFAULT; + break; + } rlength = be32_to_cpu(tpm_cmd.header.out.length); if (rlength < offsetof(struct tpm_getrandom_out, rng_data) + |