diff options
| author | Matthew R. Ochs <[email protected]> | 2024-05-22 12:06:40 +0000 |
|---|---|---|
| committer | Jarkko Sakkinen <[email protected]> | 2024-05-28 10:03:57 +0000 |
| commit | 195aba96b854dd664768f382cd1db375d8181f88 (patch) | |
| tree | 696d793032d6c1268ed7084e83674838248ce44d /drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | |
| parent | Merge tag 'pmdomain-v6.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/g... (diff) | |
| download | kernel-195aba96b854dd664768f382cd1db375d8181f88.tar.gz kernel-195aba96b854dd664768f382cd1db375d8181f88.zip | |
tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the
maximum transfer length and the size of the transfer buffer. As such, it
does not account for the 4 bytes of header that prepends the SPI data
frame. This can result in out-of-bounds accesses and was confirmed with
KASAN.
Introduce SPI_HDRSIZE to account for the header and use to allocate the
transfer buffer.
Fixes: a86a42ac2bd6 ("tpm_tis_spi: Add hardware wait polling")
Signed-off-by: Matthew R. Ochs <[email protected]>
Tested-by: Carol Soto <[email protected]>
Reviewed-by: Jarkko Sakkinen <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>
Diffstat (limited to 'drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c')
0 files changed, 0 insertions, 0 deletions