projects / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 59f5a6b) | patch
tpm: fix use after free in tpm2_load_context()
authorTadeusz Struk <tadeusz.struk@intel.com>
Wed, 9 May 2018 18:55:35 +0000 (11:55 -0700)
committerJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Mon, 14 May 2018 10:56:06 +0000 (13:56 +0300)
commit8c81c24758ffbf17cf06c6835d361ffa57be2f0e
tree1d8e67f52711db039a4396a0d79c656c6aa02cfbtree | snapshot
parent59f5a6b07f6434efac0057dc2f303a96b871811bcommit | diff
tpm: fix use after free in tpm2_load_context()

If load context command returns with TPM2_RC_HANDLE or TPM2_RC_REFERENCE_H0
then we have use after free in line 114 and double free in 117.

Fixes: 4d57856a21ed2 ("tpm2: add session handle context saving and restoring to the space code")
Cc: stable@vger.kernel.org
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off--by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
drivers/char/tpm/tpm2-space.c diff | blob | history
ep93xx device tree rework repo: git://git.maquefel.me/linux.git