diff options
| author |   Jeremy Boone <jeremy.boone@nccgroup.trust> | 2018-02-08 12:29:09 -0800 |
|---|---|---|
| committer |   James Morris <james.morris@microsoft.com> | 2018-02-26 15:43:45 -0800 |
| commit | 6d24cd186d9fead3722108dec1b1c993354645ff (patch) | |
| tree | 5af252ce6f3ad83f5efe1cf043027534421a3d92 /drivers/char/tpm | |
| parent | tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus (diff) | |
| download | linux-dev-6d24cd186d9fead3722108dec1b1c993354645ff.tar.xz linux-dev-6d24cd186d9fead3722108dec1b1c993354645ff.zip | |
tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus
Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips. In all the
driver _recv() functions, we need to use a u32 to unmarshal the
response size, otherwise a bit flip of the 31st bit would cause the
expected variable to go negative, which would then try to read a huge
amount of data. Also sanity check that the expected amount of data is
large enough for the TPM header.
Signed-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust>
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Diffstat (limited to 'drivers/char/tpm')
| -rw-r--r-- | drivers/char/tpm/st33zp24/st33zp24.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/char/tpm/st33zp24/st33zp24.c b/drivers/char/tpm/st33zp24/st33zp24.c index 4d1dc8b46877..f95b9c75175b 100644 --- a/drivers/char/tpm/st33zp24/st33zp24.c +++ b/drivers/char/tpm/st33zp24/st33zp24.c @@ -457,7 +457,7 @@ static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf, size_t count) { int size = 0; - int expected; + u32 expected; if (!chip) return -EBUSY; @@ -474,7 +474,7 @@ static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf, } expected = be32_to_cpu(*(__be32 *)(buf + 2)); - if (expected > count) { + if (expected > count || expected < TPM_HEADER_SIZE) { size = -EIO; goto out; } |