scottk/OpenCellular
1
0
Fork 0
mirror of https://github.com/Telecominfraproject/OpenCellular.git synced 2026-01-10 17:41:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

cr50: fix hash test code memory management

Browse Source 
The hash test code memory management is somewhat loose: it does not
clean up allocated buffer, but then uses it to check for presence of
the previously created handles, which can result in false positives.

Let's zero the buffer each time it is allocated and let's use
hash_test_db.contexts as the indicator if the buffer is allocated or
not.

BRANCH=cr50
BUG=none
TEST=ran ./test/tpm_test/tpmtest.py, observed rsa tests pass.

Change-Id: Iad4b4e2662fc7266ee6f556f6ddfd0051e7172d7
Signed-off-by: Vadim Bendebury <vbendeb@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/665321
Reviewed-by: Shawn N <shawnn@chromium.org>
This commit is contained in:
Vadim Bendebury
2017-09-13 09:20:30 -07:00
committed by chrome-bot
parent 3fe117d346
commit ea36e7d59b
1 changed files with 18 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
board/cr50/tpm2/hash.c
View File

@@ -190,17 +190,28 @@ static void process_start(TPM_ALG_ID alg, int handle, void *response_body,
}
if (!hash_test_db.max_contexts) {
size_t buffer_size;
/* Check how many contexts could possible fit. */
hash_test_db.max_contexts = shared_mem_size() /
sizeof(struct test_context);
buffer_size = sizeof(struct test_context) *
hash_test_db.max_contexts;
if (shared_mem_acquire(buffer_size,
(char **)&hash_test_db.contexts) !=
EC_SUCCESS) {
/* Must be out of memory. */
hash_test_db.max_contexts = 0;
*response = EXC_HASH_TOO_MANY_HANDLES;
*response_size = 1;
return;
}
memset(hash_test_db.contexts, 0, buffer_size);
}
if (!hash_test_db.contexts)
shared_mem_acquire(shared_mem_size(),
(char **)&hash_test_db.contexts);
if (!hash_test_db.contexts ||
(hash_test_db.current_context_count == hash_test_db.max_contexts)) {
if (hash_test_db.current_context_count == hash_test_db.max_contexts) {
*response = EXC_HASH_TOO_MANY_HANDLES;
*response_size = 1;
return;
@@ -246,6 +257,7 @@ static void process_finish(int handle, void *response_body,
hash_test_db.current_context_count--;
if (!hash_test_db.current_context_count) {
shared_mem_release(hash_test_db.contexts);
hash_test_db.max_contexts = 0;
return;
}