⬢ DragonFlyBSD Kernel Audit
DF-1990 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
diff --git a/sys/dev/crypto/tpm/tpm_crb.c b/sys/dev/crypto/tpm/tpm_crb.c
--- a/sys/dev/crypto/tpm/tpm_crb.c
+++ b/sys/dev/crypto/tpm/tpm_crb.c
@@ -308,7 +308,7 @@
 {
 	struct tpmcrb_sc *crb_sc;
 	uint32_t mask, curr_cmd;
-	int timeout, bytes_available;
+	int timeout, bytes_available, errval = 0;
 
 	crb_sc = (struct tpmcrb_sc *)sc;
 
@@ -342,7 +342,8 @@
 			    mask, mask, TPM_TIMEOUT_C)) {
 			device_printf(sc->dev,
 			    "Failed to transition to idle state\n");
-			return (EIO);
+			errval = EIO;
+			goto err_locality;
 		}
 	}
 	/* Switch to ready state */
@@ -353,7 +354,8 @@
 		    mask, !mask, TPM_TIMEOUT_C)) {
 		device_printf(sc->dev,
 		    "Failed to transition to ready state\n");
-		return (EIO);
+		errval = EIO;
+		goto err_locality;
 	}
 
 	/*
@@ -377,8 +379,10 @@
 	if (!tpm_wait_for_u32(sc, TPM_CRB_CTRL_START, mask, ~mask, timeout)) {
 		device_printf(sc->dev,
 		    "Timeout while waiting for device to process cmd\n");
-		if (!tpmcrb_cancel_cmd(sc))
-			return (EIO);
+		if (!tpmcrb_cancel_cmd(sc)) {
+			errval = EIO;
+			goto err_locality;
+		}
 	}
 
 	/* Read response header. Length is passed in bytes 2 - 6. */
@@ -390,18 +394,21 @@
 		device_printf(sc->dev,
 		    "Incorrect response size: %d\n",
 		    bytes_available);
-		return (EIO);
+		errval = EIO;
+		goto err_locality;
 	}
 
 	bus_read_region_stream_1(sc->mem_res, crb_sc->rsp_off + TPM_HEADER_SIZE,
 	      &sc->buf[TPM_HEADER_SIZE], bytes_available - TPM_HEADER_SIZE);
 
+err_locality:
 	OR4(sc, TPM_CRB_CTRL_REQ, TPM_CRB_CTRL_REQ_GO_IDLE);
 
 	tpmcrb_relinquish_locality(sc);
-	sc->pending_data_length = bytes_available;
+	if (errval == 0)
+		sc->pending_data_length = bytes_available;
 
-	return (0);
+	return (errval);
 }
 
 /* ACPI Driver */