From: Michael Halcrow Date: Sat, 26 Jul 2008 02:45:00 +0000 (-0700) Subject: tpm: Use correct data types for sizes in tpm_write() and tpm_read() X-Git-Tag: v2.6.27-rc1~186 X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=0147600172b4a5d261165d1aa5ef818d84da1557;p=linux-2.6-omap-h63xx.git tpm: Use correct data types for sizes in tpm_write() and tpm_read() Use the correct data types for the size parameters in tpm_write() and tpm_read(). Note that rw_verify_area() makes sure that this bug cannot be exploited to produce a buffer overrun. Signed-off-by: Michael Halcrow Cc: Marcel Selhorst Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c index f354d720b77..ae766d86845 100644 --- a/drivers/char/tpm/tpm.c +++ b/drivers/char/tpm/tpm.c @@ -1028,7 +1028,7 @@ ssize_t tpm_write(struct file *file, const char __user *buf, size_t size, loff_t *off) { struct tpm_chip *chip = file->private_data; - int in_size = size, out_size; + size_t in_size = size, out_size; /* cannot perform a write until the read has cleared either via tpm_read or a user_read_timer timeout */ @@ -1063,7 +1063,7 @@ ssize_t tpm_read(struct file *file, char __user *buf, size_t size, loff_t *off) { struct tpm_chip *chip = file->private_data; - int ret_size; + ssize_t ret_size; del_singleshot_timer_sync(&chip->user_read_timer); flush_scheduled_work();