Re: [PATCH 1/5] tpm: tpm_ppi: fix wrong error code returned to user space

[Pei Xiao]

在 2026/10/5 12:16, Jarkko Sakkinen 写道:
> On Sat, Oct 03, 2026 at 04:27:51PM +0800, Pei Xiao wrote:
>> tpm_show_ppi_response() stores its return value in an acpi_status,
>> a typedef of u32.  Both error paths of the function (-EINVAL on a
>> malformed _DSM package, -EFAULT on a non-zero operation return
>> code) end up as huge positive values when returned as ssize_t, so
>> user space cannot detect the failure with the usual "ret < 0"
>> check.
> 
> I have no idea what you mean by huge value and why that would be
> a problem, and overall this is disconnected from the code change.
> 
> Two's complement value is correctly stored in status up until the
> ssize_t cast, which results the value to be zero-extended, and
> as a result corrupt the negative values.
How does the following Git commit message look：

tpm: tpm_ppi: fix zero-extension of negative error codes

tpm_show_ppi_response() keeps its return value in an acpi_status,
a typedef of u32.  The two's complement of the error code is stored
correctly there, but on return the value is converted to ssize_t and
zero-extended, so the sign is lost: user space receives 0xFFFFFFEA
(4294967274) instead of -EINVAL, which breaks the usual "ret < 0" error
check.
Declare the variable as ssize_t so that negative values survive the
conversion.
> 
>>
>> Declare the variable as ssize_t to match the show callback's
>> return type.
>>
>> Fixes: 84b1667dea23 ("ACPI / TPM: replace open-coded _DSM code with helper functions")
>> Assisted-by: GLM-5.3
>> Signed-off-by: Pei Xiao <xiaopei01@xxxxxxxxxx>
>> ---
>>  drivers/char/tpm/tpm_ppi.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/char/tpm/tpm_ppi.c b/drivers/char/tpm/tpm_ppi.c
>> index c9793a3d986d..949fb7055bea 100644
>> --- a/drivers/char/tpm/tpm_ppi.c
>> +++ b/drivers/char/tpm/tpm_ppi.c
>> @@ -234,7 +234,7 @@ static ssize_t tpm_show_ppi_response(struct device *dev,
>>  				     struct device_attribute *attr,
>>  				     char *buf)
>>  {
>> -	acpi_status status = -EINVAL;
>> +	ssize_t status = -EINVAL;
>>  	union acpi_object *obj, *ret_obj;
>>  	u64 req, res;
>>  	struct tpm_chip *chip = to_tpm_chip(dev);
>> -- 
>> 2.25.1
>>
> 
> Br, Jarkko