On Tue, May 06, 2025 at 04:13:04PM +0200, Stefano Garzarella wrote:
> > +static int tpm_loongson_recv(struct tpm_chip *chip, u8 *buf, size_t count)
> > +{
> > + struct loongson_se_engine *tpm_engine = dev_get_drvdata(&chip->dev);
> > + struct tpm_loongson_cmd *cmd_ret = tpm_engine->command_ret;
> > +
> > + memcpy(buf, tpm_engine->data_buffer, cmd_ret->data_len);
>
> Should we limit the memcpy to `count`?
>
> I mean, can happen that `count` is less than `cmd_ret->data_len`?
It should check-and-fail:
if (cmd_ret->data_len > count)
return -EIO;
Thanks, this was a good catch.
>
> Thanks,
> Stefano
BR, Jarkko
