| From 6b07d30aca7e52f2881b8c8c20c8a2cd28e8b3d3 Mon Sep 17 00:00:00 2001 |
| From: Peter Huewe <huewe.external.infineon@googlemail.com> |
| Date: Thu, 15 Sep 2011 14:37:43 -0300 |
| Subject: TPM: Call tpm_transmit with correct size |
| |
| From: Peter Huewe <huewe.external.infineon@googlemail.com> |
| |
| commit 6b07d30aca7e52f2881b8c8c20c8a2cd28e8b3d3 upstream. |
| |
| This patch changes the call of tpm_transmit by supplying the size of the |
| userspace buffer instead of TPM_BUFSIZE. |
| |
| This got assigned CVE-2011-1161. |
| |
| [The first hunk didn't make sense given one could expect |
| way less data than TPM_BUFSIZE, so added tpm_transmit boundary |
| check over bufsiz instead |
| The last parameter of tpm_transmit() reflects the amount |
| of data expected from the device, and not the buffer size |
| being supplied to it. It isn't ideal to parse it directly, |
| so we just set it to the maximum the input buffer can handle |
| and let the userspace API to do such job.] |
| |
| Signed-off-by: Rajiv Andrade <srajiv@linux.vnet.ibm.com> |
| Signed-off-by: James Morris <jmorris@namei.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| drivers/char/tpm/tpm.c | 3 +++ |
| 1 file changed, 3 insertions(+) |
| |
| --- a/drivers/char/tpm/tpm.c |
| +++ b/drivers/char/tpm/tpm.c |
| @@ -374,6 +374,9 @@ static ssize_t tpm_transmit(struct tpm_c |
| u32 count, ordinal; |
| unsigned long stop; |
| |
| + if (bufsiz > TPM_BUFSIZE) |
| + bufsiz = TPM_BUFSIZE; |
| + |
| count = be32_to_cpu(*((__be32 *) (buf + 2))); |
| ordinal = be32_to_cpu(*((__be32 *) (buf + 6))); |
| if (count == 0) |