tpm: fix potential buffer overruns caused by bit glitches on the bus
authorJeremy Boone <jeremy.boone@nccgroup.trust>
Thu, 8 Feb 2018 20:28:08 +0000 (12:28 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 24 Mar 2018 10:00:08 +0000 (11:00 +0100)
commit890962b83636836b044022773995d5ae558499ea
tree05352d4f8fb8a14f15cab1d9ad28f647b5ecbd55
parenta779add58a837fbd5156e0fab0aca5e3b53754ef
tpm: fix potential buffer overruns caused by bit glitches on the bus

commit 3be23274755ee85771270a23af7691dc9b3a95db upstream.

Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips.  If a bit does
flip it could cause an overrun if it's in one of the size parameters,
so sanity check that we're not overrunning the provided buffer when
doing a memcpy().

Signed-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust>
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/char/tpm/tpm-interface.c
drivers/char/tpm/tpm2-cmd.c