Tadeusz Struk 8c81c24758 tpm: fix use after free in tpm2_load_context() ...

If load context command returns with TPM2_RC_HANDLE or TPM2_RC_REFERENCE_H0
then we have use after free in line 114 and double free in 117.

Fixes: 4d57856a21ed2 ("tpm2: add session handle context saving and restoring to the space code")
Cc: stable@vger.kernel.org
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off--by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

2018-05-14 13:56:06 +03:00

..

eventlog

tpm: Move eventlog declarations to its own header

2018-05-09 14:45:46 +03:00

st33zp24

tpm/st33zp24: Fix spelling mistake in macro ST33ZP24_TISREGISTER_UKNOWN

2018-05-09 14:45:46 +03:00

Kconfig

tpm: Move Linux RNG connection to hwrng

2018-01-08 12:58:36 +02:00

Makefile

tpm: Move shared eventlog functions to common.c

2018-05-09 14:45:46 +03:00

tpm2-cmd.c

tpm: fix intermittent failure with self tests

2018-03-23 10:25:09 +02:00

tpm2-space.c

tpm: fix use after free in tpm2_load_context()

2018-05-14 13:56:06 +03:00

tpm_atmel.c

tpm/tpm_atmel: remove unnecessary NULL check

2017-06-19 02:36:04 +02:00

tpm_atmel.h

tpm: remove tpm_read_index and tpm_write_index from tpm.h

2017-02-03 22:03:14 +02:00

tpm_crb.c

tpm: tpm_crb: relinquish locality on error path.

2018-05-10 01:33:00 +03:00

tpm_i2c_atmel.c

tpm: Factor out common startup code

2016-07-19 17:43:38 +03:00

tpm_i2c_infineon.c

tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus

2018-02-26 15:43:44 -08:00

tpm_i2c_nuvoton.c

tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus

2018-02-26 15:43:44 -08:00

tpm_ibmvtpm.c

tpm: ibmvtpm: simplify crq initialization and document crq format

2017-09-23 21:51:38 -07:00

tpm_ibmvtpm.h

tpm_ibmvtpm: properly handle interrupted packet receptions

2015-12-20 15:27:12 +02:00

tpm_infineon.c

tpm: replace msleep() with usleep_range() in TPM 1.2/2.0 generic drivers

2017-09-23 21:51:00 -07:00

tpm_nsc.c

tpm: remove tpm_read_index and tpm_write_index from tpm.h

2017-02-03 22:03:14 +02:00

tpm_ppi.c

ACPI: Switch to use generic guid_t in acpi_evaluate_dsm()

2017-06-07 12:20:49 +02:00

tpm_tis_core.c

tpm: reduce poll sleep time in tpm_transmit()

2018-05-14 13:48:29 +03:00

tpm_tis_core.h

kernel.h: Retain constant expression output for max()/min()

2018-04-05 14:17:16 -07:00

tpm_tis_spi.c

tpm: fix type of a local variables in tpm_tis_spi.c

2017-10-18 18:28:48 +03:00

tpm_tis.c

tpm: remove unused variables

2018-01-08 12:58:54 +02:00

tpm_vtpm_proxy.c

vfs: do bulk POLL* -> EPOLL* replacement

2018-02-11 14:34:03 -08:00

tpm-chip.c

tpm: Move Linux RNG connection to hwrng

2018-01-08 12:58:36 +02:00

tpm-dev-common.c

treewide: setup_timer() -> timer_setup()

2017-11-21 15:57:07 -08:00

tpm-dev.c

tpm: split out tpm-dev.c into tpm-dev.c and tpm-common-dev.c

2017-04-03 22:46:01 +03:00

tpm-dev.h

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

tpm-interface.c

tpm: reduce poll sleep time in tpm_transmit()

2018-05-14 13:48:29 +03:00

tpm-sysfs.c

tpm: migrate pubek_show to struct tpm_buf

2017-10-12 14:28:59 +03:00

tpm.h

tpm: reduce poll sleep time in tpm_transmit()

2018-05-14 13:48:29 +03:00

tpmrm-dev.c

tpm, tpmrm: Mark tpmrm_write as static

2017-06-13 22:02:08 +03:00

xen-tpmfront.c

tpm: move wait_for_tpm_stat() to respective driver files

2017-12-16 20:27:32 +02:00