tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the maximum transfer length and the size of the transfer buffer. As such, it does not account for the 4 bytes of header that prepends the SPI data frame. This can result in out-of-bounds accesses and was confirmed with KASAN. Introduce SPI_HDRSIZE to account for the header and use to allocate the transfer buffer. Fixes: a86a42ac2bd6 ("tpm_tis_spi: Add hardware wait polling") Signed-off-by: Matthew R. Ochs <mochs@nvidia.com> Tested-by: Carol Soto <csoto@nvidia.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
This commit is contained in:
parent
2bfcfd584f
commit
195aba96b8
@ -37,6 +37,7 @@
|
||||
#include "tpm_tis_spi.h"
|
||||
|
||||
#define MAX_SPI_FRAMESIZE 64
|
||||
#define SPI_HDRSIZE 4
|
||||
|
||||
/*
|
||||
* TCG SPI flow control is documented in section 6.4 of the spec[1]. In short,
|
||||
@ -247,7 +248,7 @@ static int tpm_tis_spi_write_bytes(struct tpm_tis_data *data, u32 addr,
|
||||
int tpm_tis_spi_init(struct spi_device *spi, struct tpm_tis_spi_phy *phy,
|
||||
int irq, const struct tpm_tis_phy_ops *phy_ops)
|
||||
{
|
||||
phy->iobuf = devm_kmalloc(&spi->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL);
|
||||
phy->iobuf = devm_kmalloc(&spi->dev, SPI_HDRSIZE + MAX_SPI_FRAMESIZE, GFP_KERNEL);
|
||||
if (!phy->iobuf)
|
||||
return -ENOMEM;
|
||||
|
||||
|
Loading…
x
Reference in New Issue
Block a user