Jerry Snitselaar 63450e38ef tpm_crb: check for bad response size ...

commit 8569defde8 upstream.

Make sure size of response buffer is at least 6 bytes, or
we will underflow and pass large size_t to memcpy_fromio().
This was encountered while testing earlier version of
locality patchset.

Fixes: 30fc8d138e ("tpm: TPM 2.0 CRB Interface")
Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-05-25 14:30:07 +02:00

..

agp

…

hw_random

hwrng: core - Don't use a stack buffer in add_early_randomness()

2016-11-18 10:48:36 +01:00

ipmi

ipmi: Fix kernel panic at ipmi_ssif_thread()

2017-05-20 14:27:03 +02:00

mwave

…

pcmcia

…

tpm

tpm_crb: check for bad response size

2017-05-25 14:30:07 +02:00

xilinx_hwicap

…

xillybus

…

apm-emulation.c

…

applicom.c

…

applicom.h

…

bfin-otp.c

…

bsr.c

…

ds1302.c

…

ds1620.c

…

dsp56k.c

…

dtlk.c

…

efirtc.c

…

generic_nvram.c

…

genrtc.c

…

hangcheck-timer.c

…

hpet.c

…

Kconfig

char: lack of bool string made CONFIG_DEVPORT always on

2017-04-21 09:30:06 +02:00

lp.c

char: lp: fix possible integer overflow in lp_setup()

2017-05-25 14:30:07 +02:00

Makefile

…

mbcs.c

…

mbcs.h

…

mem.c

mm: Tighten x86 /dev/mem with zeroing reads

2017-04-21 09:30:07 +02:00

misc.c

…

mmtimer.c

…

mspec.c

…

nsc_gpio.c

…

nvram.c

…

nwbutton.c

…

nwbutton.h

…

nwflash.c

…

pc8736x_gpio.c

…

ppdev.c

…

ps3flash.c

…

random.c

…

raw.c

…

rtc.c

…

scx200_gpio.c

…

snsc_event.c

…

snsc.c

…

snsc.h

…

sonypi.c

…

tb0219.c

…

tile-srom.c

…

tlclk.c

…

toshiba.c

…

ttyprintk.c

…

uv_mmtimer.c

…

virtio_console.c

virtio-console: avoid DMA from stack

2017-04-21 09:30:07 +02:00