Received: by 10.223.185.111 with SMTP id b44csp920621wrg; Fri, 9 Mar 2018 16:54:43 -0800 (PST) X-Google-Smtp-Source: AG47ELs/hBa5qq+GnSi29WNiRPske8Wz1cKQ8d+I3oNsPH0ACx4mnWsC4ji7v28rCqTIKQlZFJZ4 X-Received: by 10.99.177.72 with SMTP id g8mr313346pgp.99.1520643283478; Fri, 09 Mar 2018 16:54:43 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1520643283; cv=none; d=google.com; s=arc-20160816; b=czPMTzngc4ernrdDMcsbM9Fu+pxalDnQXKI9ENKUSqG1lTC7jkRP+sa7/bG9rBfJ4Z lxLpwf86Yt2qY6JD7Awp5AgJjssUKINMocJuro0tuR+7HOQSorXeUWpEKhcdpOyz5Xm/ c+6hpv6ATs/evxIV6kYf05Whbf79Gj4PTTJSHd7T9tnAw7tZvw0yENf3QzCJ9Qnsczud dXpzYVxiX1Wulb4jTXWDOlkBQS+4148anpO0oIjFsTVJhMDikvrEMMV5YZmGPJvNf2SI BIzyIJ3CMGFXDDjdpV820Xiz13jUonFdGMdPmcp7hoV9OLcj36xTMjRa6wsDwF7Hknzj 0wGg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from :arc-authentication-results; bh=ywLucK/+kezckdmjC7WU1/C24FDw/OUvqiGkeeF0s2I=; b=JhOkIzIODdWJec4X1SfPdinANpXJZCfxXKw61V1NyKFcDow0RtN5km917rpzn9lWlc i28hmlpLPw0P5EADLEpncL+WV6b7OZqsaOm6RBHRIhUgUcjc9JjhLmcPrI9I7TRTGO3a 0NRAPGL1iLzpngDD3/KYABpbo+8WrsY6ACe7XzdnDeUk+8dyYBdIPDhmMsl4iCeggQkP UwoOnTX+1ksj0XWwtl4KyPN60f8i5ZFtesicXgz2UaXMbiTBif+ZI1oATy50sTRdrzdD DmqMnUrrdYvoIzVU16V9e0/t4XitESPlyiVYE117MvLNNlbn/WYGUVF1enZ3H9bg43nO TYzQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id z23-v6si1792756plo.272.2018.03.09.16.54.29; Fri, 09 Mar 2018 16:54:43 -0800 (PST) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932706AbeCJASx (ORCPT + 99 others); Fri, 9 Mar 2018 19:18:53 -0500 Received: from mail.linuxfoundation.org ([140.211.169.12]:38366 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751325AbeCJASu (ORCPT ); Fri, 9 Mar 2018 19:18:50 -0500 Received: from localhost (unknown [185.236.200.248]) by mail.linuxfoundation.org (Postfix) with ESMTPSA id 49626DB7; Sat, 10 Mar 2018 00:18:50 +0000 (UTC) From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jeremy Boone , James Bottomley , Jarkko Sakkinen , James Morris Subject: [PATCH 3.18 01/21] tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus Date: Fri, 9 Mar 2018 16:18:23 -0800 Message-Id: <20180310001801.153607760@linuxfoundation.org> X-Mailer: git-send-email 2.16.2 In-Reply-To: <20180310001801.045114869@linuxfoundation.org> References: <20180310001801.045114869@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Jeremy Boone commit 9b8cb28d7c62568a5916bdd7ea1c9176d7f8f2ed upstream. Discrete TPMs are often connected over slow serial buses which, on some platforms, can have glitches causing bit flips. In all the driver _recv() functions, we need to use a u32 to unmarshal the response size, otherwise a bit flip of the 31st bit would cause the expected variable to go negative, which would then try to read a huge amount of data. Also sanity check that the expected amount of data is large enough for the TPM header. Signed-off-by: Jeremy Boone Cc: stable@vger.kernel.org Signed-off-by: James Bottomley Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen Signed-off-by: James Morris Signed-off-by: Greg Kroah-Hartman --- drivers/char/tpm/tpm_i2c_infineon.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/char/tpm/tpm_i2c_infineon.c +++ b/drivers/char/tpm/tpm_i2c_infineon.c @@ -436,7 +436,8 @@ static int recv_data(struct tpm_chip *ch static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count) { int size = 0; - int expected, status; + int status; + u32 expected; if (count < TPM_HEADER_SIZE) { size = -EIO; @@ -451,7 +452,7 @@ static int tpm_tis_i2c_recv(struct tpm_c } expected = be32_to_cpu(*(__be32 *)(buf + 2)); - if ((size_t) expected > count) { + if (((size_t) expected > count) || (expected < TPM_HEADER_SIZE)) { size = -EIO; goto out; }