lkml.org 
[lkml]   [2018]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.16 297/410] tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
    3.16.57-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Jeremy Boone <jeremy.boone@nccgroup.trust>

    commit 9b8cb28d7c62568a5916bdd7ea1c9176d7f8f2ed upstream.

    Discrete TPMs are often connected over slow serial buses which, on
    some platforms, can have glitches causing bit flips. In all the
    driver _recv() functions, we need to use a u32 to unmarshal the
    response size, otherwise a bit flip of the 31st bit would cause the
    expected variable to go negative, which would then try to read a huge
    amount of data. Also sanity check that the expected amount of data is
    large enough for the TPM header.

    Signed-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust>
    Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
    Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    Signed-off-by: James Morris <james.morris@microsoft.com>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    drivers/char/tpm/tpm_i2c_infineon.c | 5 +++--
    1 file changed, 3 insertions(+), 2 deletions(-)

    --- a/drivers/char/tpm/tpm_i2c_infineon.c
    +++ b/drivers/char/tpm/tpm_i2c_infineon.c
    @@ -436,7 +436,8 @@ static int recv_data(struct tpm_chip *ch
    static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count)
    {
    int size = 0;
    - int expected, status;
    + int status;
    + u32 expected;

    if (count < TPM_HEADER_SIZE) {
    size = -EIO;
    @@ -451,7 +452,7 @@ static int tpm_tis_i2c_recv(struct tpm_c
    }

    expected = be32_to_cpu(*(__be32 *)(buf + 2));
    - if ((size_t) expected > count) {
    + if (((size_t) expected > count) || (expected < TPM_HEADER_SIZE)) {
    size = -EIO;
    goto out;
    }
    \
     
     \ /
      Last update: 2018-06-07 16:19    [W:4.243 / U:0.472 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site