raspi/linux
1
0
Fork 1
mirror of https://github.com/raspberrypi/linux.git synced 2025-12-06 18:09:56 +00:00
Code Issues Projects Releases Wiki Activity

tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer

Browse Source 
[ Upstream commit 195aba96b8 ]

The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the
maximum transfer length and the size of the transfer buffer. As such, it
does not account for the 4 bytes of header that prepends the SPI data
frame. This can result in out-of-bounds accesses and was confirmed with
KASAN.

Introduce SPI_HDRSIZE to account for the header and use to allocate the
transfer buffer.

Fixes: a86a42ac2b ("tpm_tis_spi: Add hardware wait polling")
Signed-off-by: Matthew R. Ochs <mochs@nvidia.com>
Tested-by: Carol Soto <csoto@nvidia.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Matthew R. Ochs
2024-05-22 15:06:40 +03:00
committed by Greg Kroah-Hartman
parent 4ed468edfe
commit de13c56f99
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/char/tpm/tpm_tis_spi_main.c
View File

@@ -37,6 +37,7 @@
#include "tpm_tis_spi.h" #include "tpm_tis_spi.h"
#define MAX_SPI_FRAMESIZE 64 #define MAX_SPI_FRAMESIZE 64
#define SPI_HDRSIZE 4
/* /*
* TCG SPI flow control is documented in section 6.4 of the spec[1]. In short, * TCG SPI flow control is documented in section 6.4 of the spec[1]. In short,
@@ -247,7 +248,7 @@ static int tpm_tis_spi_write_bytes(struct tpm_tis_data *data, u32 addr,
int tpm_tis_spi_init(struct spi_device *spi, struct tpm_tis_spi_phy *phy, int tpm_tis_spi_init(struct spi_device *spi, struct tpm_tis_spi_phy *phy,
int irq, const struct tpm_tis_phy_ops *phy_ops) int irq, const struct tpm_tis_phy_ops *phy_ops)
{ {
phy->iobuf = devm_kmalloc(&spi->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL); phy->iobuf = devm_kmalloc(&spi->dev, SPI_HDRSIZE + MAX_SPI_FRAMESIZE, GFP_KERNEL);
if (!phy->iobuf) if (!phy->iobuf)
return -ENOMEM; return -ENOMEM;