aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJeremy Boone <jeremy.boone@nccgroup.trust>2018-02-08 15:30:01 -0500
committerJames Morris <james.morris@microsoft.com>2018-02-26 18:43:44 -0500
commit9b8cb28d7c62568a5916bdd7ea1c9176d7f8f2ed (patch)
treec22b00d42dc3bfe21697fe7f4f164850d5c08693
parentf9d4d9b5a5ef2f017bc344fb65a58a902517173b (diff)
tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
Discrete TPMs are often connected over slow serial buses which, on some platforms, can have glitches causing bit flips. In all the driver _recv() functions, we need to use a u32 to unmarshal the response size, otherwise a bit flip of the 31st bit would cause the expected variable to go negative, which would then try to read a huge amount of data. Also sanity check that the expected amount of data is large enough for the TPM header. Signed-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust> Cc: stable@vger.kernel.org Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: James Morris <james.morris@microsoft.com>
-rw-r--r--drivers/char/tpm/tpm_i2c_infineon.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c
index c1dd39eaaeeb..6116cd05e228 100644
--- a/drivers/char/tpm/tpm_i2c_infineon.c
+++ b/drivers/char/tpm/tpm_i2c_infineon.c
@@ -473,7 +473,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
473static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count) 473static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count)
474{ 474{
475 int size = 0; 475 int size = 0;
476 int expected, status; 476 int status;
477 u32 expected;
477 478
478 if (count < TPM_HEADER_SIZE) { 479 if (count < TPM_HEADER_SIZE) {
479 size = -EIO; 480 size = -EIO;
@@ -488,7 +489,7 @@ static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count)
488 } 489 }
489 490
490 expected = be32_to_cpu(*(__be32 *)(buf + 2)); 491 expected = be32_to_cpu(*(__be32 *)(buf + 2));
491 if ((size_t) expected > count) { 492 if (((size_t) expected > count) || (expected < TPM_HEADER_SIZE)) {
492 size = -EIO; 493 size = -EIO;
493 goto out; 494 goto out;
494 } 495 }