Skip to contentSkip to conversation

FAILED: patch "[PATCH] tpm: fix potential buffer overruns caused by bit glitches on" failed to apply to 4.4-stable tree

PATCH [email protected] 1 participant 1 message Mar 6, 2018

Subsystems (2)
Stable branch TPM device driver
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 4.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

Quoted 1 line

From 3be23274755ee85771270a23af7691dc9b3a95db Mon Sep 17 00:00:00 2001

From: Jeremy Boone <[email protected]>
Date: Thu, 8 Feb 2018 12:28:08 -0800
Subject: [PATCH] tpm: fix potential buffer overruns caused by bit glitches on
the bus

Discrete TPMs are often connected over slow serial buses which, on some platforms, can have glitches causing bit flips. If a bit does flip it could cause an overrun if it's in one of the size parameters, so sanity check that we're not overrunning the provided buffer when doing a memcpy().

Signed-off-by Jeremy Boone <[email protected]>
Cc [email protected]
Signed-off-by James Bottomley <[email protected]>
Reviewed-by Jarkko Sakkinen <[email protected]>
Tested-by Jarkko Sakkinen <[email protected]>
Signed-off-by Jarkko Sakkinen <[email protected]>
Signed-off-by James Morris <[email protected]>
drivers/char/tpm/tpm-interface.c +4 -0
index 76df4fbcf089..9e80a953d693 100644
@@ -1190,6 +1190,10 @@ int tpm_get_random(struct tpm_chip *chip, u8 *out, size_t max)
 			break;
 
 		recd = be32_to_cpu(tpm_cmd.params.getrandom_out.rng_data_len);
+		if (recd > num_bytes) {
+			total = -EFAULT;
+			break;
+		}
 
 		rlength = be32_to_cpu(tpm_cmd.header.out.length);
 		if (rlength < offsetof(struct tpm_getrandom_out, rng_data) +
drivers/char/tpm/tpm2-cmd.c +4 -0
index c17e75348a99..a700f8f9ead7 100644
@@ -683,6 +683,10 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
 	if (!rc) {
 		data_len = be16_to_cpup(
 			(__be16 *) &buf.data[TPM_HEADER_SIZE + 4]);
+		if (data_len < MIN_KEY_SIZE ||  data_len > MAX_KEY_SIZE + 1) {
+			rc = -EFAULT;
+			goto out;
+		}
 
 		rlength = be32_to_cpu(((struct tpm2_cmd *)&buf)
 					->header.out.length);