Jeremy Boone 9be164624e tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus ... commit 6d24cd186d upstream. Discrete TPMs are often connected over slow serial buses which, on some platforms, can have glitches causing bit flips. In all the driver _recv() functions, we need to use a u32 to unmarshal the response size, otherwise a bit flip of the 31st bit would cause the expected variable to go negative, which would then try to read a huge amount of data. Also sanity check that the expected amount of data is large enough for the TPM header. Signed-off-by: Jeremy Boone <jeremy.boone@nccgroup.trust> Cc: stable@vger.kernel.org Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Signed-off-by: James Morris <james.morris@microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-03-11 16:21:27 +01:00
..
Kconfig	tpm/st33zp24: Auto-select core module	2016-06-25 17:21:42 +03:00
Makefile	tpm/st33zp24/spi: Add st33zp24 spi phy	2015-03-18 22:43:06 +01:00
i2c.c	tpm: Remove useless priv field in struct tpm_vendor_specific	2016-06-25 17:26:35 +03:00
spi.c	tpm: Remove useless priv field in struct tpm_vendor_specific	2016-06-25 17:26:35 +03:00
st33zp24.c	tpm: st33zp24: fix potential buffer overruns caused by bit glitches on the bus	2018-03-11 16:21:27 +01:00
st33zp24.h	tpm: drop 'locality' from struct tpm_vendor_specific	2016-06-25 17:26:35 +03:00