Commit 195aba96 authored by Matthew R. Ochs's avatar Matthew R. Ochs Committed by Jarkko Sakkinen
Browse files

tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer 



The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the
maximum transfer length and the size of the transfer buffer. As such, it
does not account for the 4 bytes of header that prepends the SPI data
frame. This can result in out-of-bounds accesses and was confirmed with
KASAN.

Introduce SPI_HDRSIZE to account for the header and use to allocate the
transfer buffer.

Fixes: a86a42ac ("tpm_tis_spi: Add hardware wait polling")
Signed-off-by: default avatarMatthew R. Ochs <mochs@nvidia.com>
Tested-by: default avatarCarol Soto <csoto@nvidia.com>
Reviewed-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
parent 2bfcfd58

drivers/char/tpm/tpm_tis_spi_main.c

+2 −1
Original line number Diff line number Diff line
@@ -37,6 +37,7 @@ 
#include "tpm_tis_spi.h"



#define MAX_SPI_FRAMESIZE 64

#define SPI_HDRSIZE 4



/*

 * TCG SPI flow control is documented in section 6.4 of the spec[1]. In short,
@@ -247,7 +248,7 @@ static int tpm_tis_spi_write_bytes(struct tpm_tis_data *data, u32 addr, 
int tpm_tis_spi_init(struct spi_device *spi, struct tpm_tis_spi_phy *phy,

		     int irq, const struct tpm_tis_phy_ops *phy_ops)

{

	phy->iobuf = devm_kmalloc(&spi->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL);

	phy->iobuf = devm_kmalloc(&spi->dev, SPI_HDRSIZE + MAX_SPI_FRAMESIZE, GFP_KERNEL);

	if (!phy->iobuf)

		return -ENOMEM;