]> git.hungrycats.org Git - linux/commit
tpm: st33zp24: Validate locality read result
authorRuoyu Wang <ruoyuw560@gmail.com>
Thu, 13 Aug 2026 15:30:32 +0000 (23:30 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Mon, 14 Sep 2026 11:36:13 +0000 (13:36 +0200)
commitfdc992f4bc45f4e11110eeb530ca61679ac2b2fc
tree430bc840dcd874932cfd2714934fcb6db1d5de91
parent14feaa498c20c1b7ddefe27de5329aaff822cc0d
tpm: st33zp24: Validate locality read result

[ Upstream commit 264216889d39df509b9c8045df53529480b0b718 ]

check_locality() treats every nonzero transport return as success. SPI
errors remain negative, while the I2C path can convert a negative write
error through its byte-sized status variable. Either result is nonzero
even though the TPM_ACCESS byte can remain unwritten, so indeterminate
ACTIVE_LOCALITY and VALID bits can falsely report an active locality.

Require recv() to return exactly the requested byte before examining
TPM_ACCESS. Transport errors and short reads now report an inactive
locality, while successful reads retain the existing behavior.

This issue was found by a static analysis checker and confirmed by manual
source review.

Fixes: 251a7b08213a ("TPM: STMicroelectronics ST33 I2C KERNEL 3.x")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Link: https://lore.kernel.org/r/20260813153032.3951878-2-ruoyuw560@gmail.com
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/char/tpm/st33zp24/st33zp24.c