Re: [PATCH v7] tpm: Check size of response before accessing data

[Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>]

On Thu, Jan 19, 2017 at 07:19:12AM -0500, Stefan Berger wrote:
> Make sure that we have not received less bytes than what is indicated
> in the header of the TPM response. Also, check the number of bytes in
> the response before accessing its data.
> 
> Signed-off-by: Stefan Berger <stefanb@linux.vnet.ibm.com>

Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

/Jarkko

> 
> --
> 
> v7:
>  - Followed Jarkko's suggestions on v6
> 
> v6:
>  - Fixed comparsion of size_t with negative number in transmit_cmd
>  - Added new min_rx_length parameter to documentation
>  - Reworked error checking in tpm_transmit_cmd to check for TPM
>    error and return that before validating expected minimum size.
> 
> v5:
>  - Fixed a bug related to tpm_getcap() having to allow to return
>    only a header rather than having to receive a full response
> 
> ---
>  drivers/char/tpm/tpm-interface.c | 69 ++++++++++++++++++++++++++++------------
>  drivers/char/tpm/tpm-sysfs.c     | 28 ++++++++++------
>  drivers/char/tpm/tpm.h           |  7 ++--
>  drivers/char/tpm/tpm2-cmd.c      | 66 ++++++++++++++++++++++++++++----------
>  drivers/char/tpm/tpm_tis_core.c  |  3 +-
>  5 files changed, 123 insertions(+), 50 deletions(-)
> 
> diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
> index a3461cb..24cc6ec 100644
> --- a/drivers/char/tpm/tpm-interface.c
> +++ b/drivers/char/tpm/tpm-interface.c
> @@ -425,6 +425,7 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,
>   * @chip: TPM chip to use
>   * @cmd: TPM command buffer
>   * @len: length of the TPM command
> + * @min_rsp_body_length: minimum expected length of response body
>   * @flags: tpm transmit flags - bitmap
>   * @desc: command description used in the error message
>   *
> @@ -434,25 +435,35 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,
>   *     A positive number for a TPM error.
>   */
>  ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd,
> -			 int len, unsigned int flags, const char *desc)
> +			 size_t len, size_t min_rsp_body_length,
> +			 unsigned int flags, const char *desc)
>  {
>  	const struct tpm_output_header *header;
>  	int err;
> +	ssize_t length;
>  
> -	len = tpm_transmit(chip, (const u8 *)cmd, len, flags);
> -	if (len <  0)
> -		return len;
> -	else if (len < TPM_HEADER_SIZE)
> +	length = tpm_transmit(chip, (const u8 *)cmd, len, flags);
> +	if (length <  0)
> +		return length;
> +	else if (length < TPM_HEADER_SIZE)
>  		return -EFAULT;
>  
>  	header = cmd;
> +	if (length < be32_to_cpu(header->length))
> +		return -EFAULT;
>  
>  	err = be32_to_cpu(header->return_code);
>  	if (err != 0 && desc)
>  		dev_err(&chip->dev, "A TPM error (%d) occurred %s\n", err,
>  			desc);
> +	if (err)
> +		return err;
>  
> -	return err;
> +	if (be32_to_cpu(header->length) <
> +	    min_rsp_body_length + TPM_HEADER_SIZE)
> +		return -EFAULT;
> +
> +	return 0;
>  }
>  
>  #define TPM_DIGEST_SIZE 20
> @@ -468,7 +479,7 @@ static const struct tpm_input_header tpm_getcap_header = {
>  };
>  
>  ssize_t tpm_getcap(struct tpm_chip *chip, u32 subcap_id, cap_t *cap,
> -		   const char *desc)
> +		   const char *desc, size_t min_cap_length)
>  {
>  	struct tpm_cmd_t tpm_cmd;
>  	int rc;
> @@ -491,8 +502,8 @@ ssize_t tpm_getcap(struct tpm_chip *chip, u32 subcap_id, cap_t *cap,
>  		tpm_cmd.params.getcap_in.subcap_size = cpu_to_be32(4);
>  		tpm_cmd.params.getcap_in.subcap = cpu_to_be32(subcap_id);
>  	}
> -	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
> -			      desc);
> +	rc = tpm_transmit_cmd(chip, &tpm_cmd, TPM_INTERNAL_RESULT_SIZE,
> +			      min_cap_length, 0, desc);
>  	if (!rc)
>  		*cap = tpm_cmd.params.getcap_out.cap;
>  	return rc;
> @@ -516,7 +527,7 @@ static int tpm_startup(struct tpm_chip *chip, __be16 startup_type)
>  
>  	start_cmd.params.startup_in.startup_type = startup_type;
>  	return tpm_transmit_cmd(chip, &start_cmd, TPM_INTERNAL_RESULT_SIZE, 0,
> -				"attempting to start the TPM");
> +				0, "attempting to start the TPM");
>  }
>  
>  int tpm_get_timeouts(struct tpm_chip *chip)
> @@ -545,7 +556,8 @@ int tpm_get_timeouts(struct tpm_chip *chip)
>  		return 0;
>  	}
>  
> -	rc = tpm_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, NULL);
> +	rc = tpm_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, NULL,
> +			sizeof(cap.timeout));
>  	if (rc == TPM_ERR_INVALID_POSTINIT) {
>  		/* The TPM is not started, we are the first to talk to it.
>  		   Execute a startup command. */
> @@ -554,8 +566,10 @@ int tpm_get_timeouts(struct tpm_chip *chip)
>  			return rc;
>  
>  		rc = tpm_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap,
> -				"attempting to determine the timeouts");
> +				"attempting to determine the timeouts",
> +				sizeof(cap.timeout));
>  	}
> +
>  	if (rc) {
>  		dev_err(&chip->dev,
>  			"A TPM error (%zd) occurred attempting to determine the timeouts\n",
> @@ -617,7 +631,8 @@ int tpm_get_timeouts(struct tpm_chip *chip)
>  	chip->timeout_d = usecs_to_jiffies(timeout_eff[3]);
>  
>  	rc = tpm_getcap(chip, TPM_CAP_PROP_TIS_DURATION, &cap,
> -			"attempting to determine the durations");
> +			"attempting to determine the durations",
> +			sizeof(cap.duration));
>  	if (rc)
>  		return rc;
>  
> @@ -668,13 +683,14 @@ static int tpm_continue_selftest(struct tpm_chip *chip)
>  	struct tpm_cmd_t cmd;
>  
>  	cmd.header.in = continue_selftest_header;
> -	rc = tpm_transmit_cmd(chip, &cmd, CONTINUE_SELFTEST_RESULT_SIZE, 0,
> +	rc = tpm_transmit_cmd(chip, &cmd, CONTINUE_SELFTEST_RESULT_SIZE, 0, 0,
>  			      "continue selftest");
>  	return rc;
>  }
>  
>  #define TPM_ORDINAL_PCRREAD cpu_to_be32(21)
>  #define READ_PCR_RESULT_SIZE 30
> +#define READ_PCR_RESULT_BODY_SIZE 20
>  static const struct tpm_input_header pcrread_header = {
>  	.tag = TPM_TAG_RQU_COMMAND,
>  	.length = cpu_to_be32(14),
> @@ -688,7 +704,8 @@ int tpm_pcr_read_dev(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
>  
>  	cmd.header.in = pcrread_header;
>  	cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
> -	rc = tpm_transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE, 0,
> +	rc = tpm_transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE,
> +			      READ_PCR_RESULT_BODY_SIZE, 0,
>  			      "attempting to read a pcr value");
>  
>  	if (rc == 0)
> @@ -751,6 +768,7 @@ EXPORT_SYMBOL_GPL(tpm_pcr_read);
>  
>  #define TPM_ORD_PCR_EXTEND cpu_to_be32(20)
>  #define EXTEND_PCR_RESULT_SIZE 34
> +#define EXTEND_PCR_RESULT_BODY_SIZE 24
>  static const struct tpm_input_header pcrextend_header = {
>  	.tag = TPM_TAG_RQU_COMMAND,
>  	.length = cpu_to_be32(34),
> @@ -786,7 +804,8 @@ int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash)
>  	cmd.header.in = pcrextend_header;
>  	cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(pcr_idx);
>  	memcpy(cmd.params.pcrextend_in.hash, hash, TPM_DIGEST_SIZE);
> -	rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE, 0,
> +	rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
> +			      EXTEND_PCR_RESULT_BODY_SIZE, 0,
>  			      "attempting extend a PCR value");
>  
>  	tpm_put_ops(chip);
> @@ -890,7 +909,7 @@ int tpm_send(u32 chip_num, void *cmd, size_t buflen)
>  	if (chip == NULL)
>  		return -ENODEV;
>  
> -	rc = tpm_transmit_cmd(chip, cmd, buflen, 0, "attempting tpm_cmd");
> +	rc = tpm_transmit_cmd(chip, cmd, buflen, 0, 0, "attempting tpm_cmd");
>  
>  	tpm_put_ops(chip);
>  	return rc;
> @@ -992,7 +1011,8 @@ int tpm_pm_suspend(struct device *dev)
>  		cmd.params.pcrextend_in.pcr_idx = cpu_to_be32(tpm_suspend_pcr);
>  		memcpy(cmd.params.pcrextend_in.hash, dummy_hash,
>  		       TPM_DIGEST_SIZE);
> -		rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE, 0,
> +		rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE,
> +				     EXTEND_PCR_RESULT_BODY_SIZE, 0,
>  				      "extending dummy pcr before suspend");
>  	}
>  
> @@ -1000,7 +1020,7 @@ int tpm_pm_suspend(struct device *dev)
>  	for (try = 0; try < TPM_RETRY; try++) {
>  		cmd.header.in = savestate_header;
>  		rc = tpm_transmit_cmd(chip, &cmd, SAVESTATE_RESULT_SIZE, 0,
> -				      NULL);
> +				      0, NULL);
>  
>  		/*
>  		 * If the TPM indicates that it is too busy to respond to
> @@ -1062,7 +1082,7 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max)
>  {
>  	struct tpm_chip *chip;
>  	struct tpm_cmd_t tpm_cmd;
> -	u32 recd, num_bytes = min_t(u32, max, TPM_MAX_RNG_DATA);
> +	u32 recd, num_bytes = min_t(u32, max, TPM_MAX_RNG_DATA), rlength;
>  	int err, total = 0, retries = 5;
>  	u8 *dest = out;
>  
> @@ -1085,11 +1105,20 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max)
>  
>  		err = tpm_transmit_cmd(chip, &tpm_cmd,
>  				       TPM_GETRANDOM_RESULT_SIZE + num_bytes,
> +				       offsetof(struct tpm_getrandom_out,
> +						rng_data),
>  				       0, "attempting get random");
>  		if (err)
>  			break;
>  
>  		recd = be32_to_cpu(tpm_cmd.params.getrandom_out.rng_data_len);
> +
> +		rlength = be32_to_cpu(tpm_cmd.header.out.length);
> +		if (rlength < offsetof(struct tpm_getrandom_out, rng_data) +
> +			      recd) {
> +			total = -EFAULT;
> +			break;
> +		}
>  		memcpy(dest, tpm_cmd.params.getrandom_out.rng_data, recd);
>  
>  		dest += recd;
> diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c
> index 848ad65..2f596d7 100644
> --- a/drivers/char/tpm/tpm-sysfs.c
> +++ b/drivers/char/tpm/tpm-sysfs.c
> @@ -21,6 +21,7 @@
>  #include "tpm.h"
>  
>  #define READ_PUBEK_RESULT_SIZE 314
> +#define READ_PUBEK_RESULT_MIN_BODY_SIZE (28 + 256)
>  #define TPM_ORD_READPUBEK cpu_to_be32(124)
>  static const struct tpm_input_header tpm_readpubek_header = {
>  	.tag = TPM_TAG_RQU_COMMAND,
> @@ -39,7 +40,8 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr,
>  	struct tpm_chip *chip = to_tpm_chip(dev);
>  
>  	tpm_cmd.header.in = tpm_readpubek_header;
> -	err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE, 0,
> +	err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
> +			       READ_PUBEK_RESULT_MIN_BODY_SIZE, 0,
>  			       "attempting to read the PUBEK");
>  	if (err)
>  		goto out;
> @@ -95,7 +97,8 @@ static ssize_t pcrs_show(struct device *dev, struct device_attribute *attr,
>  	struct tpm_chip *chip = to_tpm_chip(dev);
>  
>  	rc = tpm_getcap(chip, TPM_CAP_PROP_PCR, &cap,
> -			"attempting to determine the number of PCRS");
> +			"attempting to determine the number of PCRS",
> +			sizeof(cap.num_pcrs));
>  	if (rc)
>  		return 0;
>  
> @@ -120,7 +123,8 @@ static ssize_t enabled_show(struct device *dev, struct device_attribute *attr,
>  	ssize_t rc;
>  
>  	rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_PERM, &cap,
> -			"attempting to determine the permanent enabled state");
> +			"attempting to determine the permanent enabled state",
> +			sizeof(cap.perm_flags));
>  	if (rc)
>  		return 0;
>  
> @@ -136,7 +140,8 @@ static ssize_t active_show(struct device *dev, struct device_attribute *attr,
>  	ssize_t rc;
>  
>  	rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_PERM, &cap,
> -			"attempting to determine the permanent active state");
> +			"attempting to determine the permanent active state",
> +			sizeof(cap.perm_flags));
>  	if (rc)
>  		return 0;
>  
> @@ -152,7 +157,8 @@ static ssize_t owned_show(struct device *dev, struct device_attribute *attr,
>  	ssize_t rc;
>  
>  	rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_PROP_OWNER, &cap,
> -			"attempting to determine the owner state");
> +			"attempting to determine the owner state",
> +			sizeof(cap.owned));
>  	if (rc)
>  		return 0;
>  
> @@ -168,7 +174,8 @@ static ssize_t temp_deactivated_show(struct device *dev,
>  	ssize_t rc;
>  
>  	rc = tpm_getcap(to_tpm_chip(dev), TPM_CAP_FLAG_VOL, &cap,
> -			"attempting to determine the temporary state");
> +			"attempting to determine the temporary state",
> +			sizeof(cap.stclear_flags));
>  	if (rc)
>  		return 0;
>  
> @@ -186,7 +193,8 @@ static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
>  	char *str = buf;
>  
>  	rc = tpm_getcap(chip, TPM_CAP_PROP_MANUFACTURER, &cap,
> -			"attempting to determine the manufacturer");
> +			"attempting to determine the manufacturer",
> +			sizeof(cap.manufacturer_id));
>  	if (rc)
>  		return 0;
>  	str += sprintf(str, "Manufacturer: 0x%x\n",
> @@ -194,7 +202,8 @@ static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
>  
>  	/* Try to get a TPM version 1.2 TPM_CAP_VERSION_INFO */
>  	rc = tpm_getcap(chip, TPM_CAP_VERSION_1_2, &cap,
> -			"attempting to determine the 1.2 version");
> +			"attempting to determine the 1.2 version",
> +			sizeof(cap.tpm_version_1_2));
>  	if (!rc) {
>  		str += sprintf(str,
>  			       "TCG version: %d.%d\nFirmware version: %d.%d\n",
> @@ -205,7 +214,8 @@ static ssize_t caps_show(struct device *dev, struct device_attribute *attr,
>  	} else {
>  		/* Otherwise just use TPM_STRUCT_VER */
>  		rc = tpm_getcap(chip, TPM_CAP_VERSION_1_1, &cap,
> -				"attempting to determine the 1.1 version");
> +				"attempting to determine the 1.1 version",
> +				sizeof(cap.tpm_version));
>  		if (rc)
>  			return 0;
>  		str += sprintf(str,
> diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
> index 1ae9768..7d34048 100644
> --- a/drivers/char/tpm/tpm.h
> +++ b/drivers/char/tpm/tpm.h
> @@ -493,10 +493,11 @@ enum tpm_transmit_flags {
>  
>  ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz,
>  		     unsigned int flags);
> -ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd, int len,
> -			 unsigned int flags, const char *desc);
> +ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd, size_t len,
> +			 size_t min_rsp_body_len, unsigned int flags,
> +			 const char *desc);
>  ssize_t tpm_getcap(struct tpm_chip *chip, u32 subcap_id, cap_t *cap,
> -		   const char *desc);
> +		   const char *desc, size_t min_cap_length);
>  int tpm_get_timeouts(struct tpm_chip *);
>  int tpm1_auto_startup(struct tpm_chip *chip);
>  int tpm_do_selftest(struct tpm_chip *chip);
> diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
> index 6eda239..a0199f1 100644
> --- a/drivers/char/tpm/tpm2-cmd.c
> +++ b/drivers/char/tpm/tpm2-cmd.c
> @@ -248,6 +248,9 @@ static const u8 tpm2_ordinal_duration[TPM2_CC_LAST - TPM2_CC_FIRST + 1] = {
>  	(sizeof(struct tpm_input_header) + \
>  	 sizeof(struct tpm2_pcr_read_in))
>  
> +#define TPM2_PCR_READ_RESP_BODY_SIZE \
> +	 sizeof(struct tpm2_pcr_read_out)
> +
>  static const struct tpm_input_header tpm2_pcrread_header = {
>  	.tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
>  	.length = cpu_to_be32(TPM2_PCR_READ_IN_SIZE),
> @@ -280,8 +283,9 @@ int tpm2_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
>  	       sizeof(cmd.params.pcrread_in.pcr_select));
>  	cmd.params.pcrread_in.pcr_select[pcr_idx >> 3] = 1 << (pcr_idx & 0x7);
>  
> -	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
> -			      "attempting to read a pcr value");
> +	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd),
> +			      TPM2_PCR_READ_RESP_BODY_SIZE,
> +			      0, "attempting to read a pcr value");
>  	if (rc == 0) {
>  		buf = cmd.params.pcrread_out.digest;
>  		memcpy(res_buf, buf, TPM_DIGEST_SIZE);
> @@ -327,7 +331,7 @@ int tpm2_pcr_extend(struct tpm_chip *chip, int pcr_idx, const u8 *hash)
>  	cmd.params.pcrextend_in.hash_alg = cpu_to_be16(TPM2_ALG_SHA1);
>  	memcpy(cmd.params.pcrextend_in.digest, hash, TPM_DIGEST_SIZE);
>  
> -	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
> +	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, 0,
>  			      "attempting extend a PCR value");
>  
>  	return rc;
> @@ -356,7 +360,7 @@ static const struct tpm_input_header tpm2_getrandom_header = {
>  int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max)
>  {
>  	struct tpm2_cmd cmd;
> -	u32 recd;
> +	u32 recd, rlength;
>  	u32 num_bytes;
>  	int err;
>  	int total = 0;
> @@ -373,13 +377,19 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max)
>  		cmd.header.in = tpm2_getrandom_header;
>  		cmd.params.getrandom_in.size = cpu_to_be16(num_bytes);
>  
> -		err = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
> -				       "attempting get random");
> +		err = tpm_transmit_cmd(chip, &cmd, sizeof(cmd),
> +				       offsetof(struct tpm2_get_random_out,
> +						buffer),
> +				       0, "attempting get random");
>  		if (err)
>  			break;
>  
>  		recd = min_t(u32, be16_to_cpu(cmd.params.getrandom_out.size),
>  			     num_bytes);
> +		rlength = be32_to_cpu(cmd.header.out.length);
> +		if (rlength < offsetof(struct tpm2_get_random_out, buffer) +
> +			      recd)
> +			return -EFAULT;
>  		memcpy(dest, cmd.params.getrandom_out.buffer, recd);
>  
>  		dest += recd;
> @@ -394,6 +404,9 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *out, size_t max)
>  	(sizeof(struct tpm_input_header) + \
>  	 sizeof(struct tpm2_get_tpm_pt_in))
>  
> +#define TPM2_GET_TPM_PT_OUT_BODY_SIZE \
> +	 sizeof(struct tpm2_get_tpm_pt_out)
> +
>  static const struct tpm_input_header tpm2_get_tpm_pt_header = {
>  	.tag = cpu_to_be16(TPM2_ST_NO_SESSIONS),
>  	.length = cpu_to_be32(TPM2_GET_TPM_PT_IN_SIZE),
> @@ -445,7 +458,7 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
>  {
>  	unsigned int blob_len;
>  	struct tpm_buf buf;
> -	u32 hash;
> +	u32 hash, rlength;
>  	int i;
>  	int rc;
>  
> @@ -510,7 +523,8 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
>  		goto out;
>  	}
>  
> -	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, 0, "sealing data");
> +	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, 4, 0,
> +			      "sealing data");
>  	if (rc)
>  		goto out;
>  
> @@ -519,6 +533,11 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
>  		rc = -E2BIG;
>  		goto out;
>  	}
> +	rlength = be32_to_cpu(((struct tpm2_cmd *)&buf)->header.out.length);
> +	if (rlength < TPM_HEADER_SIZE + 4 + blob_len) {
> +		rc = -EFAULT;
> +		goto out;
> +	}
>  
>  	memcpy(payload->blob, &buf.data[TPM_HEADER_SIZE + 4], blob_len);
>  	payload->blob_len = blob_len;
> @@ -588,7 +607,8 @@ static int tpm2_load_cmd(struct tpm_chip *chip,
>  		goto out;
>  	}
>  
> -	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, flags, "loading blob");
> +	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, 4, flags,
> +			      "loading blob");
>  	if (!rc)
>  		*blob_handle = be32_to_cpup(
>  			(__be32 *) &buf.data[TPM_HEADER_SIZE]);
> @@ -626,7 +646,7 @@ static void tpm2_flush_context_cmd(struct tpm_chip *chip, u32 handle,
>  
>  	tpm_buf_append_u32(&buf, handle);
>  
> -	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, flags,
> +	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, 0, flags,
>  			      "flushing context");
>  	if (rc)
>  		dev_warn(&chip->dev, "0x%08x was not flushed, rc=%d\n", handle,
> @@ -657,6 +677,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
>  	u16 data_len;
>  	u8 *data;
>  	int rc;
> +	u32 rlength;
>  
>  	rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_UNSEAL);
>  	if (rc)
> @@ -671,13 +692,21 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
>  			     options->blobauth /* hmac */,
>  			     TPM_DIGEST_SIZE);
>  
> -	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, flags, "unsealing");
> +	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, 6, flags,
> +			      "unsealing");
>  	if (rc > 0)
>  		rc = -EPERM;
>  
>  	if (!rc) {
>  		data_len = be16_to_cpup(
>  			(__be16 *) &buf.data[TPM_HEADER_SIZE + 4]);
> +
> +		rlength = be32_to_cpu(((struct tpm2_cmd *)&buf)
> +					->header.out.length);
> +		if (rlength < TPM_HEADER_SIZE + 6 + data_len) {
> +			rc = -EFAULT;
> +			goto out;
> +		}
>  		data = &buf.data[TPM_HEADER_SIZE + 6];
>  
>  		memcpy(payload->key, data, data_len - 1);
> @@ -685,6 +714,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip,
>  		payload->migratable = data[data_len - 1];
>  	}
>  
> +out:
>  	tpm_buf_destroy(&buf);
>  	return rc;
>  }
> @@ -739,7 +769,8 @@ ssize_t tpm2_get_tpm_pt(struct tpm_chip *chip, u32 property_id,  u32 *value,
>  	cmd.params.get_tpm_pt_in.property_id = cpu_to_be32(property_id);
>  	cmd.params.get_tpm_pt_in.property_cnt = cpu_to_be32(1);
>  
> -	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, desc);
> +	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd),
> +			      TPM2_GET_TPM_PT_OUT_BODY_SIZE, 0, desc);
>  	if (!rc)
>  		*value = be32_to_cpu(cmd.params.get_tpm_pt_out.value);
>  
> @@ -773,7 +804,7 @@ static int tpm2_startup(struct tpm_chip *chip, u16 startup_type)
>  	cmd.header.in = tpm2_startup_header;
>  
>  	cmd.params.startup_in.startup_type = cpu_to_be16(startup_type);
> -	return tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0,
> +	return tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, 0,
>  				"attempting to start the TPM");
>  }
>  
> @@ -802,7 +833,8 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
>  	cmd.header.in = tpm2_shutdown_header;
>  	cmd.params.startup_in.startup_type = cpu_to_be16(shutdown_type);
>  
> -	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, "stopping the TPM");
> +	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, 0,
> +			      "stopping the TPM");
>  
>  	/* In places where shutdown command is sent there's no much we can do
>  	 * except print the error code on a system failure.
> @@ -865,7 +897,7 @@ static int tpm2_start_selftest(struct tpm_chip *chip, bool full)
>  	cmd.header.in = tpm2_selftest_header;
>  	cmd.params.selftest_in.full_test = full;
>  
> -	rc = tpm_transmit_cmd(chip, &cmd, TPM2_SELF_TEST_IN_SIZE, 0,
> +	rc = tpm_transmit_cmd(chip, &cmd, TPM2_SELF_TEST_IN_SIZE, 0, 0,
>  			      "continue selftest");
>  
>  	/* At least some prototype chips seem to give RC_TESTING error
> @@ -916,7 +948,7 @@ static int tpm2_do_selftest(struct tpm_chip *chip)
>  		cmd.params.pcrread_in.pcr_select[1] = 0x00;
>  		cmd.params.pcrread_in.pcr_select[2] = 0x00;
>  
> -		rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, NULL);
> +		rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, 0, NULL);
>  		if (rc < 0)
>  			break;
>  
> @@ -949,7 +981,7 @@ int tpm2_probe(struct tpm_chip *chip)
>  	cmd.params.get_tpm_pt_in.property_id = cpu_to_be32(0x100);
>  	cmd.params.get_tpm_pt_in.property_cnt = cpu_to_be32(1);
>  
> -	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd),  0, NULL);
> +	rc = tpm_transmit_cmd(chip, &cmd, sizeof(cmd), 0, 0, NULL);
>  	if (rc <  0)
>  		return rc;
>  
> diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
> index 0cfc0ee..45f8840 100644
> --- a/drivers/char/tpm/tpm_tis_core.c
> +++ b/drivers/char/tpm/tpm_tis_core.c
> @@ -552,7 +552,8 @@ static int tpm_tis_gen_interrupt(struct tpm_chip *chip)
>  	if (chip->flags & TPM_CHIP_FLAG_TPM2)
>  		return tpm2_get_tpm_pt(chip, 0x100, &cap2, desc);
>  	else
> -		return tpm_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc);
> +		return tpm_getcap(chip, TPM_CAP_PROP_TIS_TIMEOUT, &cap, desc,
> +				  0);
>  }
>  
>  /* Register the IRQ and issue a command that will cause an interrupt. If an
> -- 
> 2.4.3
>