Skip to contentSkip to conversation

tpm_crb: check for bad response size

PATCH In review Jerry Snitselaar 2 participants 2 messages Mar 11, 2017 TPM device driver

lore
Share & tools
lore

Jerry Snitselaar

author
#0 lore raw

PATCH 1/1 tpm_crb: check for bad response size

Make sure size of response buffer is at least 6 bytes, or we will underflow and pass large size_t to memcpy_fromio(). This was encountered while testing earlier version of locality patchset.

Fixes 30fc8d138e912 ("tpm: TPM 2.0 CRB Interface")
Signed-off-by Jerry Snitselaar <[email protected]>
---
 drivers/char/tpm/tpm_crb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/tpm/tpm_crb.c +1 -1
index 89dc8a176ff1..cda4f312d1c9 100644
@@ -236,7 +236,7 @@ static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 
 	memcpy_fromio(buf, priv->rsp, 6);
 	expected = be32_to_cpup((__be32 *) &buf[2]);
-	if (expected > count)
+	if (expected > count || expected < 6)
 		return -EIO;
 
 	memcpy_fromio(&buf[6], &priv->rsp[6], expected - 6);
Signature · 1 line
2.11.0.258.ge05806da9
Reviewed-by on v1 1/1
#1 lore raw
Quoted 7 lines · Jerry Snitselaar

Make sure size of response buffer is at least 6 bytes, or we will underflow and pass large size_t to memcpy_fromio(). This was encountered while testing earlier version of locality patchset.

Fixes 30fc8d138e912 ("tpm: TPM 2.0 CRB Interface")
Signed-off-by Jerry Snitselaar <[email protected]>
Reviewed-by Jarkko Sakkinen <jarkko.sakkinen-VuQAYsv1563Yd54FQh9/[email protected]>

/Jarkko

Quoted 20 lines
---
 drivers/char/tpm/tpm_crb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/char/tpm/tpm_crb.c +1 -1
index 89dc8a176ff1..cda4f312d1c9 100644
@@ -236,7 +236,7 @@ static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 
 	memcpy_fromio(buf, priv->rsp, 6);
 	expected = be32_to_cpup((__be32 *) &buf[2]);
-	if (expected > count)
+	if (expected > count || expected < 6)
 		return -EIO;
 
 	memcpy_fromio(&buf[6], &priv->rsp[6], expected - 6);
Signature · 1 line
2.11.0.258.ge05806da9

------------------------------------------------------------------------------
Announcing the Oxford Dictionaries API! The API offers world-renowned dictionary content that is easy and intuitive to access. Sign up for an account today to start using our lexical data to power your apps and projects. Get started today and enter our developer competition.
http://sdm.link/oxford