1 files changed, 6 insertions, 0 deletions

diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c
index 610638a80383..461bf0b8a094 100644
--- a/drivers/char/tpm/tpm-dev-common.c
+++ b/drivers/char/tpm/tpm-dev-common.c
@@ -110,6 +110,12 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf,
                 return -EFAULT;
         }
 
+        if (in_size < 6 ||
+            in_size < be32_to_cpu(*((__be32 *) (priv->data_buffer + 2)))) {
+                mutex_unlock(&priv->buffer_mutex);
+                return -EINVAL;
+        }
+
         /* atomic tpm command send and result receive. We only hold the ops
          * lock during this period so that the tpm can be unregistered even if
          * the char dev is held open.