tpm: fix potential buffer overruns caused by bit glitches on the bus
authorJeremy Boone <jeremy.boone@nccgroup.trust>
Thu, 8 Feb 2018 20:28:08 +0000 (12:28 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 9 Mar 2018 06:41:00 +0000 (22:41 -0800)
commit648b62fda1a35c9198689cca76ace580a67e7872
treeb8047049c5ca3398fd38284f5abac290bd39e1a0
parent703fca31ac31ed81455a8642a6988cbca47f0f07
tpm: fix potential buffer overruns caused by bit glitches on the bus

commit 3be23274755ee85771270a23af7691dc9b3a95db upstream.

Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips.  If a bit does
flip it could cause an overrun if it's in one of the size parameters,
so sanity check that we're not overrunning the provided buffer when
doing a memcpy().

Signed-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust>
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/char/tpm/tpm-interface.c
drivers/char/tpm/tpm2-cmd.c