tpm: fix potential buffer overruns caused by bit glitches on the bus
authorJeremy Boone <jeremy.boone@nccgroup.trust>
Thu, 8 Feb 2018 20:28:08 +0000 (12:28 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 24 Mar 2018 09:58:39 +0000 (10:58 +0100)
commita5291a8c6d00dced63310502343aa979a5c5674c
tree49946b36b148f9e42fa65d6cf8fd484553976f01
parent3753696b0aee3f3f55e161ef41d2cb0ea7e6e225
tpm: fix potential buffer overruns caused by bit glitches on the bus

commit 3be23274755ee85771270a23af7691dc9b3a95db upstream.

Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips.  If a bit does
flip it could cause an overrun if it's in one of the size parameters,
so sanity check that we're not overrunning the provided buffer when
doing a memcpy().

Signed-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust>
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/char/tpm/tpm-interface.c
drivers/char/tpm/tpm2-cmd.c