kpriv/linux-hardened
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

tpm: move length validation to tpm_transmit()

Browse source 
Check that the length matches the length reported by the response
header already in tpm_transmit() to improve validation.

Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: James Bottomley <James.Bottomley@HansenPartnership.com>
This commit is contained in:
Jarkko Sakkinen 2017-02-14 21:57:42 +02:00
parent 38eb24ebb0
commit a147918e79
1 changed files with 12 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
drivers/char/tpm/tpm-interface.c
View file

@ -343,6 +343,7 @@ EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz, ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,
unsigned int flags) unsigned int flags)
{ {
const struct tpm_output_header *header = (void *)buf;
ssize_t rc; ssize_t rc;
u32 count, ordinal; u32 count, ordinal;
unsigned long stop; unsigned long stop;
@ -406,9 +407,18 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,
out_recv: out_recv:
rc = chip->ops->recv(chip, (u8 *) buf, bufsiz); rc = chip->ops->recv(chip, (u8 *) buf, bufsiz);
if (rc < 0) if (rc < 0) {
dev_err(&chip->dev, dev_err(&chip->dev,
"tpm_transmit: tpm_recv: error %zd\n", rc); "tpm_transmit: tpm_recv: error %zd\n", rc);
goto out;
} else if (rc < TPM_HEADER_SIZE) {
rc = -EFAULT;
goto out;
}
if (rc != be32_to_cpu(header->length))
goto out;
out: out:
if (chip->dev.parent) if (chip->dev.parent)
pm_runtime_put_sync(chip->dev.parent); pm_runtime_put_sync(chip->dev.parent);
@ -438,19 +448,13 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *buf,
size_t bufsiz, size_t min_rsp_body_length, size_t bufsiz, size_t min_rsp_body_length,
unsigned int flags, const char *desc) unsigned int flags, const char *desc)
{ {
const struct tpm_output_header *header; const struct tpm_output_header *header = buf;
int err; int err;
ssize_t len; ssize_t len;
len = tpm_transmit(chip, (const u8 *)buf, bufsiz, flags); len = tpm_transmit(chip, (const u8 *)buf, bufsiz, flags);
if (len < 0) if (len < 0)
return len; return len;
else if (len < TPM_HEADER_SIZE)
return -EFAULT;
header = buf;
if (len != be32_to_cpu(header->length))
return -EFAULT;
err = be32_to_cpu(header->return_code); err = be32_to_cpu(header->return_code);
if (err != 0 && desc) if (err != 0 && desc)