From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932229AbcIKMTI (ORCPT ); Sun, 11 Sep 2016 08:19:08 -0400 Received: from mga06.intel.com ([134.134.136.31]:21682 "EHLO mga06.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756020AbcIKMTH (ORCPT ); Sun, 11 Sep 2016 08:19:07 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.30,316,1470726000"; d="scan'208";a="7233717" From: Jarkko Sakkinen To: Peter Huewe Cc: Jarkko Sakkinen , Marcel Selhorst , Jason Gunthorpe , tpmdd-devel@lists.sourceforge.net (moderated list:TPM DEVICE DRIVER), linux-kernel@vger.kernel.org (open list) Subject: [PATCH] tpm: fix buffer overflow in /dev/tpm0 Date: Sun, 11 Sep 2016 15:19:00 +0300 Message-Id: <1473596340-11376-1-git-send-email-jarkko.sakkinen@linux.intel.com> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org tpm_write() does not check whether the buffer has at least enough space for the header before passing it to tpm_transmit() so an overflow can happen. Signed-off-by: Jarkko Sakkinen --- drivers/char/tpm/tpm-interface.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index fd863ff..6a67f7f 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -337,6 +337,9 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz, u32 count, ordinal; unsigned long stop; + if (bufsiz < TPM_HEADER_SIZE) + return -EINVAL; + if (bufsiz > TPM_BUFSIZE) bufsiz = TPM_BUFSIZE; -- 2.7.4