diff options
| author | Jeremy Boone <jeremy.boone@nccgroup.trust> | 2018-02-08 12:30:01 -0800 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@microsoft.com> | 2018-03-20 23:49:46 -0400 |
| commit | f49123e361fd503b6bdfc6c512259a7103d61d1c (patch) | |
| tree | 1395e7331a46dbf18344944e9ac5cbb912780cb0 /drivers | |
| parent | 5e0b41c73710f26884619f97843fa395edcdf7a3 (diff) | |
tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
[ Upstream commit 9b8cb28d7c62568a5916bdd7ea1c9176d7f8f2ed ]
Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips. In all the
driver _recv() functions, we need to use a u32 to unmarshal the
response size, otherwise a bit flip of the 31st bit would cause the
expected variable to go negative, which would then try to read a huge
amount of data. Also sanity check that the expected amount of data is
large enough for the TPM header.
Signed-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust>
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/char/tpm/tpm_i2c_infineon.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c index 33c5f360ab01..ff9ed941862a 100644 --- a/drivers/char/tpm/tpm_i2c_infineon.c +++ b/drivers/char/tpm/tpm_i2c_infineon.c @@ -436,7 +436,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count) static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count) { int size = 0; - int expected, status; + int status; + u32 expected; if (count < TPM_HEADER_SIZE) { size = -EIO; @@ -451,7 +452,7 @@ static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count) } expected = be32_to_cpu(*(__be32 *)(buf + 2)); - if ((size_t) expected > count) { + if (((size_t) expected > count) || (expected < TPM_HEADER_SIZE)) { size = -EIO; goto out; } |