tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus
authorJeremy Boone <jeremy.boone@nccgroup.trust>
Thu, 8 Feb 2018 20:30:01 +0000 (12:30 -0800)
committerBen Hutchings <ben@decadent.org.uk>
Sat, 16 Jun 2018 21:22:27 +0000 (22:22 +0100)
commit611e1526f93fa92986dc3bb37bc7f4ad0b7f6f01
tree04f4e249aa0abaec909a6f9a5026e73a72c73993
parenteefc5b494f4ae757cb79ee83d51f0861511b1b8f
tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus

commit 9b8cb28d7c62568a5916bdd7ea1c9176d7f8f2ed upstream.

Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips.  In all the
driver _recv() functions, we need to use a u32 to unmarshal the
response size, otherwise a bit flip of the 31st bit would cause the
expected variable to go negative, which would then try to read a huge
amount of data.  Also sanity check that the expected amount of data is
large enough for the TPM header.

Signed-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust>
Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/char/tpm/tpm_i2c_infineon.c