lkml.org 
[lkml]   [2024]   [May]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH v2] tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
From
On Wed May 22, 2024 at 4:59 AM EEST, Matthew R. Ochs wrote:
> The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the
> maximum transfer length and the size of the transfer buffer. As such, it
> does not account for the 4 bytes of header that prepends the SPI data
> frame. This can result in out-of-bounds accesses and was confirmed with
> KASAN.
>
> Introduce SPI_HDRSIZE to account for the header and use to allocate the
> transfer buffer.
>
> Fixes: a86a42ac2bd6 ("tpm_tis_spi: Add hardware wait polling")
> Signed-off-by: Matthew R. Ochs <mochs@nvidia.com>
> Tested-by: Carol Soto <csoto@nvidia.com>
> ---
> v2: Removed MAX_SPI_BUFSIZE in favor of open coding the buffer allocation
> ---
> drivers/char/tpm/tpm_tis_spi_main.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/char/tpm/tpm_tis_spi_main.c b/drivers/char/tpm/tpm_tis_spi_main.c
> index 3f9eaf27b41b..c9eca24bbad4 100644
> --- a/drivers/char/tpm/tpm_tis_spi_main.c
> +++ b/drivers/char/tpm/tpm_tis_spi_main.c
> @@ -37,6 +37,7 @@
> #include "tpm_tis_spi.h"
>
> #define MAX_SPI_FRAMESIZE 64
> +#define SPI_HDRSIZE 4
>
> /*
> * TCG SPI flow control is documented in section 6.4 of the spec[1]. In short,
> @@ -247,7 +248,7 @@ static int tpm_tis_spi_write_bytes(struct tpm_tis_data *data, u32 addr,
> int tpm_tis_spi_init(struct spi_device *spi, struct tpm_tis_spi_phy *phy,
> int irq, const struct tpm_tis_phy_ops *phy_ops)
> {
> - phy->iobuf = devm_kmalloc(&spi->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL);
> + phy->iobuf = devm_kmalloc(&spi->dev, SPI_HDRSIZE + MAX_SPI_FRAMESIZE, GFP_KERNEL);
> if (!phy->iobuf)
> return -ENOMEM;
>

Thanks, this is much better. Now when reading the code after months go
by, it is easy to see why the metrics for buffer size are what they
are.

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

Given that it is a bug fix, I can put this to rc2 pull request. Thanks
for finding and fixing the bug.

BR, Jarkko

\
 
 \ /
  Last update: 2024-05-22 14:04    [W:0.046 / U:0.208 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site