From: Jeremy Boone Date: Thu, 8 Feb 2018 20:32:06 +0000 (-0800) Subject: tpm_tis: fix potential buffer overruns caused by bit glitches on the bus X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=72686d527c0d3566ec96ec6d834ce08596c10c62;p=pandora-kernel.git tpm_tis: fix potential buffer overruns caused by bit glitches on the bus commit 6bb320ca4a4a7b5b3db8c8d7250cc40002046878 upstream. Discrete TPMs are often connected over slow serial buses which, on some platforms, can have glitches causing bit flips. In all the driver _recv() functions, we need to use a u32 to unmarshal the response size, otherwise a bit flip of the 31st bit would cause the expected variable to go negative, which would then try to read a huge amount of data. Also sanity check that the expected amount of data is large enough for the TPM header. Signed-off-by: Jeremy Boone Signed-off-by: James Bottomley Tested-by: Jarkko Sakkinen Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen Signed-off-by: James Morris [bwh: Backported to 3.2: adjust filename] Signed-off-by: Ben Hutchings --- Reading git-diff-tree failed