]> git.baikalelectronics.ru Git - kernel.git/commit
tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus
authorJeremy Boone <jeremy.boone@nccgroup.trust>
Thu, 8 Feb 2018 20:31:16 +0000 (12:31 -0800)
committerJames Morris <james.morris@microsoft.com>
Mon, 26 Feb 2018 23:43:44 +0000 (15:43 -0800)
commitf90a943ca8309026ac803dfa61518b3ee8785b1a
tree61c7e930f780cd8e27a8c794821c6e9c5a6c7ab3
parent422712c73b73f3ef0863a47820e9867b42bf185d
tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus

Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips.  In all the
driver _recv() functions, we need to use a u32 to unmarshal the
response size, otherwise a bit flip of the 31st bit would cause the
expected variable to go negative, which would then try to read a huge
amount of data.  Also sanity check that the expected amount of data is
large enough for the TPM header.

Signed-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust>
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
drivers/char/tpm/tpm_i2c_nuvoton.c