From patchwork Tue Jul 4 13:54:19 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexander Steffen X-Patchwork-Id: 9825185 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id BCF4A602F0 for ; Tue, 4 Jul 2017 14:29:36 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id AA07126E16 for ; Tue, 4 Jul 2017 14:29:36 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9C09E274B4; Tue, 4 Jul 2017 14:29:36 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.wl.linuxfoundation.org (Postfix) with ESMTPS id 2A70826E16 for ; Tue, 4 Jul 2017 14:29:35 +0000 (UTC) Received: from localhost ([127.0.0.1] helo=sfs-ml-3.v29.ch3.sourceforge.com) by sfs-ml-3.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1dSOpa-00009w-NH; Tue, 04 Jul 2017 14:29:34 +0000 Received: from sog-mx-1.v43.ch3.sourceforge.com ([172.29.43.191] helo=mx.sourceforge.net) by sfs-ml-3.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1dSOpZ-00009p-Ql for tpmdd-devel@lists.sourceforge.net; Tue, 04 Jul 2017 14:29:33 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sourceforge.net; s=x; h=Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=hgb2RGtdAkgrF/RsGw0RFtm6StKBJjScKuGDpieQpLI=; b=lH2G8/pFUlf0sCb7c85BEfTBiFYCMR2dob3hc3/hUpBNxU+5i/MRv+hImOQ0mndhGvhFBqYjjbXNJWVnJPAR/KZiKHCfa+oJi6VR2EXAo/bf3EXqZ6yS4yAo4C/YPhGxHdH3WsSGHGVLEi1KurnVsMWzda3RZ5cVS5GAc242rbU=; DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=sf.net; s=x; h=Content-Type:MIME-Version:References:In-Reply-To:Message-ID:Date:Subject:CC:To:From; bh=hgb2RGtdAkgrF/RsGw0RFtm6StKBJjScKuGDpieQpLI=; b=Xv0IDSA6oA+ImT5HwJCLWk7OR9PqevkoCYcfqM/2GgPbw+pcDnQk1bAb3I310tPf4xufhZEdf3+um1MCNRseDpAIGFMOsBOmuf2G5wivu5GuUwxxPVOU3XYT68OBiHso0lOUK2cEhtgN3hyYT62Mfmvfm0jT0ugsgeqUI/rkabg=; Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of infineon.com designates 217.10.52.18 as permitted sender) client-ip=217.10.52.18; envelope-from=alexander.steffen@infineon.com; helo=smtp2.infineon.com; Received: from smtp2.infineon.com ([217.10.52.18]) by sog-mx-1.v43.ch3.sourceforge.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.76) id 1dSOpY-0005r2-R1 for tpmdd-devel@lists.sourceforge.net; Tue, 04 Jul 2017 14:29:33 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=infineon.com; i=@infineon.com; q=dns/txt; s=IFXMAIL; t=1499178572; x=1530714572; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version; bh=KhyBcvzP27Uq8IxwkY8QLXBbjYnF4kSFEFaZ//GILxc=; b=lxBwTg8eg2ajjgs39U5TvQxJF6/uAEfyAR3Znf6O1Q6IkxAHJ82tA71L cTpsiMHLkoSorDLVc7kjmOEY89DD6jEM5s+bWwazKSwz3mBzt4SxAnFHI nwnTENwUCpQxOP2yGU5yy4W2H3oBLCmMqKYUCA7P7SJoGo0HwM2m952kI g=; X-SBRS: None Received: from unknown (HELO mucxv002.muc.infineon.com) ([172.23.11.17]) by smtp2.infineon.com with ESMTP/TLS/AES256-GCM-SHA384; 04 Jul 2017 15:54:47 +0200 Received: from MUCSE609.infineon.com (unknown [172.23.7.110]) by mucxv002.muc.infineon.com (Postfix) with ESMTPS; Tue, 4 Jul 2017 15:54:47 +0200 (CEST) Received: from MUCSE603.infineon.com (172.23.7.104) by MUCSE609.infineon.com (172.23.7.110) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Tue, 4 Jul 2017 15:54:46 +0200 Received: from ABGN5CG4522MQD.eu.infineon.com (172.29.170.97) by MUCSE603.infineon.com (172.23.7.104) with Microsoft SMTP Server (TLS) id 15.0.1263.5; Tue, 4 Jul 2017 15:54:46 +0200 From: Alexander Steffen To: Date: Tue, 4 Jul 2017 15:54:19 +0200 Message-ID: <20170704135419.1692-2-Alexander.Steffen@infineon.com> X-Mailer: git-send-email 2.11.1.windows.1 In-Reply-To: <20170704135419.1692-1-Alexander.Steffen@infineon.com> References: <20170704135419.1692-1-Alexander.Steffen@infineon.com> MIME-Version: 1.0 X-Originating-IP: [172.29.170.97] X-ClientProxiedBy: MUCSE601.infineon.com (172.23.7.102) To MUCSE603.infineon.com (172.23.7.104) X-Headers-End: 1dSOpY-0005r2-R1 Subject: [tpmdd-devel] [PATCH 2/2] tpm-interface: Fix checks of buffer size X-BeenThere: tpmdd-devel@lists.sourceforge.net X-Mailman-Version: 2.1.21 Precedence: list List-Id: Tpm Device Driver maintainance List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: stable@vger.kernel.org Errors-To: tpmdd-devel-bounces@lists.sourceforge.net X-Virus-Scanned: ClamAV using ClamSMTP bufsiz contains the length of the buffer, whereas bufvalid contains the number of valid bytes within the buffer. Therefore, bufvalid should be used as a limit when reading from the buffer and bufsize when writing to it. Cc: stable@vger.kernel.org Signed-off-by: Alexander Steffen --- drivers/char/tpm/tpm-interface.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index a452cd0..5ef8eb3 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -393,19 +393,16 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space, unsigned long stop; bool need_locality; - if (!tpm_validate_command(chip, space, buf, bufsiz)) + if (!tpm_validate_command(chip, space, buf, bufvalid)) return -EINVAL; - if (bufsiz > TPM_BUFSIZE) - bufsiz = TPM_BUFSIZE; - count = be32_to_cpu(*((__be32 *) (buf + 2))); ordinal = be32_to_cpu(*((__be32 *) (buf + 6))); if (count == 0) return -ENODATA; - if (count > bufsiz || count > bufvalid) { + if (count > bufvalid) { dev_err(&chip->dev, - "invalid count value %x %zx\n", count, bufsiz); + "invalid count value %x %zx\n", count, bufvalid); return -E2BIG; }