From: Kylene Jo Hall <kjhall@us.ibm.com>

This patch will determine the size of the buffer in the sysfs functions
based on the size of the command structure(s), such as tpm_cap, and the
known amount of data the command will return.  The receive functions are
smart enough not to overflow the buffer should the command response change.

Signed-off-by: Kylie Hall <kjhall@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 drivers/char/tpm/tpm.c |   15 +++++++--------
 1 files changed, 7 insertions(+), 8 deletions(-)

diff -puN drivers/char/tpm/tpm.c~tpm-new-12-sysfs-files-fix drivers/char/tpm/tpm.c
--- 25/drivers/char/tpm/tpm.c~tpm-new-12-sysfs-files-fix	Tue Apr 11 15:13:50 2006
+++ 25-akpm/drivers/char/tpm/tpm.c	Tue Apr 11 15:13:50 2006
@@ -486,7 +486,7 @@ static ssize_t transmit_cmd(struct tpm_c
 
 void tpm_gen_interrupt(struct tpm_chip *chip)
 {
-	u8 data[30];
+	u8 data[max(ARRAY_SIZE(tpm_cap), 30)];
 	ssize_t rc;
 
 	memcpy(data, tpm_cap, sizeof(tpm_cap));
@@ -500,7 +500,7 @@ EXPORT_SYMBOL_GPL(tpm_gen_interrupt);
 
 void tpm_get_timeouts(struct tpm_chip *chip)
 {
-	u8 data[30];
+	u8 data[max(ARRAY_SIZE(tpm_cap), 30)];
 	ssize_t rc;
 	u32 timeout;
 
@@ -560,7 +560,6 @@ EXPORT_SYMBOL_GPL(tpm_get_timeouts);
 
 void tpm_continue_selftest(struct tpm_chip *chip)
 {
-
 	u8 data[] = {
 		0, 193,			/* TPM_TAG_RQU_COMMAND */
 		0, 0, 0, 10,		/* length */
@@ -574,7 +573,7 @@ EXPORT_SYMBOL_GPL(tpm_continue_selftest)
 ssize_t tpm_show_enabled(struct device * dev, struct device_attribute * attr,
 			char *buf)
 {
-	u8 data[35];
+	u8 data[max(ARRAY_SIZE(tpm_cap), 30)];
 	ssize_t rc;
 
 	struct tpm_chip *chip = dev_get_drvdata(dev);
@@ -596,7 +595,7 @@ EXPORT_SYMBOL_GPL(tpm_show_enabled);
 ssize_t tpm_show_active(struct device * dev, struct device_attribute * attr,
 			char *buf)
 {
-	u8 data[35];
+	u8 data[max(ARRAY_SIZE(tpm_cap), 35)];
 	ssize_t rc;
 
 	struct tpm_chip *chip = dev_get_drvdata(dev);
@@ -669,7 +668,7 @@ static const u8 pcrread[] = {
 ssize_t tpm_show_pcrs(struct device *dev, struct device_attribute *attr,
 		      char *buf)
 {
-	u8 data[30];
+	u8 data[max(max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(pcrread)), 30)];
 	ssize_t rc;
 	int i, j, num_pcrs;
 	__be32 index;
@@ -786,7 +785,7 @@ static const u8 cap_version[] = {
 ssize_t tpm_show_caps(struct device *dev, struct device_attribute *attr,
 		      char *buf)
 {
-	u8 data[30];
+	u8 data[max(max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
 	ssize_t rc;
 	char *str = buf;
 
@@ -826,7 +825,7 @@ EXPORT_SYMBOL_GPL(tpm_show_caps);
 ssize_t tpm_show_caps_1_2(struct device * dev,
 			  struct device_attribute * attr, char *buf)
 {
-	u8 data[30];
+	u8 data[max(max(ARRAY_SIZE(tpm_cap), ARRAY_SIZE(cap_version)), 30)];
 	ssize_t len;
 	char *str = buf;
 
_