| Message ID | 20240522015932.3742421-1-mochs@nvidia.com |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer | expand |
On Wed May 22, 2024 at 4:59 AM EEST, Matthew R. Ochs wrote: > The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the > maximum transfer length and the size of the transfer buffer. As such, it > does not account for the 4 bytes of header that prepends the SPI data > frame. This can result in out-of-bounds accesses and was confirmed with > KASAN. > > Introduce SPI_HDRSIZE to account for the header and use to allocate the > transfer buffer. > > Fixes: a86a42ac2bd6 ("tpm_tis_spi: Add hardware wait polling") > Signed-off-by: Matthew R. Ochs <mochs@nvidia.com> > Tested-by: Carol Soto <csoto@nvidia.com> > --- > v2: Removed MAX_SPI_BUFSIZE in favor of open coding the buffer allocation > --- > drivers/char/tpm/tpm_tis_spi_main.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/drivers/char/tpm/tpm_tis_spi_main.c b/drivers/char/tpm/tpm_tis_spi_main.c > index 3f9eaf27b41b..c9eca24bbad4 100644 > --- a/drivers/char/tpm/tpm_tis_spi_main.c > +++ b/drivers/char/tpm/tpm_tis_spi_main.c > @@ -37,6 +37,7 @@ > #include "tpm_tis_spi.h" > > #define MAX_SPI_FRAMESIZE 64 > +#define SPI_HDRSIZE 4 > > /* > * TCG SPI flow control is documented in section 6.4 of the spec[1]. In short, > @@ -247,7 +248,7 @@ static int tpm_tis_spi_write_bytes(struct tpm_tis_data *data, u32 addr, > int tpm_tis_spi_init(struct spi_device *spi, struct tpm_tis_spi_phy *phy, > int irq, const struct tpm_tis_phy_ops *phy_ops) > { > - phy->iobuf = devm_kmalloc(&spi->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL); > + phy->iobuf = devm_kmalloc(&spi->dev, SPI_HDRSIZE + MAX_SPI_FRAMESIZE, GFP_KERNEL); > if (!phy->iobuf) > return -ENOMEM; > Thanks, this is much better. Now when reading the code after months go by, it is easy to see why the metrics for buffer size are what they are. Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Given that it is a bug fix, I can put this to rc2 pull request. Thanks for finding and fixing the bug. BR, Jarkko
diff --git a/drivers/char/tpm/tpm_tis_spi_main.c b/drivers/char/tpm/tpm_tis_spi_main.c index 3f9eaf27b41b..c9eca24bbad4 100644 --- a/drivers/char/tpm/tpm_tis_spi_main.c +++ b/drivers/char/tpm/tpm_tis_spi_main.c @@ -37,6 +37,7 @@ #include "tpm_tis_spi.h" #define MAX_SPI_FRAMESIZE 64 +#define SPI_HDRSIZE 4 /* * TCG SPI flow control is documented in section 6.4 of the spec[1]. In short, @@ -247,7 +248,7 @@ static int tpm_tis_spi_write_bytes(struct tpm_tis_data *data, u32 addr, int tpm_tis_spi_init(struct spi_device *spi, struct tpm_tis_spi_phy *phy, int irq, const struct tpm_tis_phy_ops *phy_ops) { - phy->iobuf = devm_kmalloc(&spi->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL); + phy->iobuf = devm_kmalloc(&spi->dev, SPI_HDRSIZE + MAX_SPI_FRAMESIZE, GFP_KERNEL); if (!phy->iobuf) return -ENOMEM;
The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the maximum transfer length and the size of the transfer buffer. As such, it does not account for the 4 bytes of header that prepends the SPI data frame. This can result in out-of-bounds accesses and was confirmed with KASAN. Introduce SPI_HDRSIZE to account for the header and use to allocate the transfer buffer. Fixes: a86a42ac2bd6 ("tpm_tis_spi: Add hardware wait polling") Signed-off-by: Matthew R. Ochs <mochs@nvidia.com> Tested-by: Carol Soto <csoto@nvidia.com> --- v2: Removed MAX_SPI_BUFSIZE in favor of open coding the buffer allocation --- drivers/char/tpm/tpm_tis_spi_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)