On Fri, 2023-10-27 at 08:24 -0400, James Bottomley wrote:
> On Tue, 2023-10-24 at 04:15 +0300, Jarkko Sakkinen wrote:
> > +++ b/drivers/char/tpm/tpm-buf.c
> > @@ -124,3 +124,72 @@ void tpm_buf_append_u32(struct tpm_buf *buf,
> > const u32 value)
> > tpm_buf_append(buf, (u8 *)&value2, 4);
> > }
> > EXPORT_SYMBOL_GPL(tpm_buf_append_u32);
> > +
> > +/**
> > + * tpm_buf_read() - Read from a TPM buffer
> > + * @buf: &tpm_buf instance
> > + * @offset: offset within the buffer
> > + * @count: the number of bytes to read
> > + * @output: the output buffer
> > + */
> > +static void tpm_buf_read(const struct tpm_buf *buf, off_t *offset,
> > size_t count, void *output)
> > +{
> > + if (*(offset + count) >= buf->length) {
>
> I don't think you mean that; it's dereferencing a random location in
> the stack, which is why I see this check trip randomly when testing. I
> think you mean
>
> if (*offset + count >= buf->length) {
>
> James
Yes, true! Thank you.
BR, Jarkko
