tpmdd-devel.lists.sourceforge.net archive mirror
 help / color / mirror / Atom feed
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: Alexander.Steffen@infineon.com
Cc: tpmdd-devel@lists.sourceforge.net, stable@vger.kernel.org
Subject: Re: [PATCH RESEND 1/2] tpm-dev-common: Reject too short writes
Date: Wed, 30 Aug 2017 13:40:59 +0300	[thread overview]
Message-ID: <20170830104059.sglgybn3fxh24qjr@linux.intel.com> (raw)
In-Reply-To: <6039fbecc07044a88706a41441f62d18@MUCSE603.infineon.com>

On Mon, Aug 28, 2017 at 05:11:00PM +0000, Alexander.Steffen@infineon.com wrote:
> > > diff --git a/drivers/char/tpm/tpm-dev-common.c
> > > b/drivers/char/tpm/tpm-dev-common.c
> > > index 610638a..c39b581 100644
> > > --- a/drivers/char/tpm/tpm-dev-common.c
> > > +++ b/drivers/char/tpm/tpm-dev-common.c
> > > @@ -119,7 +119,7 @@ ssize_t tpm_common_write(struct file *file, const
> > char __user *buf,
> > >  		return -EPIPE;
> > >  	}
> > >  	out_size = tpm_transmit(priv->chip, space, priv->data_buffer,
> > > -				sizeof(priv->data_buffer), 0);
> > > +				sizeof(priv->data_buffer), in_size, 0);
> > 
> > Why you couldn't just
> > 
> > unsigned int bufsiz;
> > 
> > /* ... */
> > 
> > bufsiz = sizeof(priv->data_buffer);
> > if (in_size < bufsiz)
> > 	bufsiz = in_size;
> > 
> > out_size = tpm_transmit(priv->chip, space, priv->data_buffer, bufsiz, 0);
> 
> Because the code needs to know both how large the buffer is (in order to avoid buffer overflows when writing to it) and how much of the data in the buffer is valid (in order not to send random junk to the TPM). This is made more explicit in PATCH 2/2.
> 
> Your example fails as soon as the response is longer than the command.
> 
> Alexander

Got you.

Do the comparison for count tpm-dev-common.c as it is the only call site
where this is needed instead of scrabbling with the parameters. In other
call sites this is unnecessary at this point.

This will also make backporting a factor more sleek.

/Jarkko

  reply	other threads:[~2017-08-30 10:40 UTC|newest]

Thread overview: 10+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-08-24  8:35 [PATCH RESEND 0/2] Avoid sending invalid data to the TPM Alexander Steffen
     [not found] ` <20170824083545.13280-1-Alexander.Steffen-d0qZbvYSIPpWk0Htik3J/w@public.gmane.org>
2017-08-24  8:35   ` [PATCH RESEND 1/2] tpm-dev-common: Reject too short writes Alexander Steffen
2017-08-25 16:54     ` Jarkko Sakkinen
     [not found]       ` <20170825165451.b7lv7t5w3nhbz7da-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
2017-08-28 17:11         ` Alexander.Steffen-d0qZbvYSIPpWk0Htik3J/w
2017-08-30 10:40           ` Jarkko Sakkinen [this message]
2017-09-04 17:35             ` Alexander.Steffen
     [not found]               ` <dd865ba5751e4d568709e0aaf209633b-nFblLGNE8XKJSz+rYg/bSJowlv4uC7bZ@public.gmane.org>
2017-09-05 19:02                 ` Jarkko Sakkinen
2017-08-24  8:35   ` [PATCH RESEND 2/2] tpm-interface: Fix checks of buffer size Alexander Steffen
2017-08-25 16:44   ` [PATCH RESEND 0/2] Avoid sending invalid data to the TPM Jarkko Sakkinen
     [not found]     ` <20170825164416.svo7khm4zsmosxbx-VuQAYsv1563Yd54FQh9/CA@public.gmane.org>
2017-09-01 12:08       ` Alexander.Steffen-d0qZbvYSIPpWk0Htik3J/w

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170830104059.sglgybn3fxh24qjr@linux.intel.com \
    --to=jarkko.sakkinen@linux.intel.com \
    --cc=Alexander.Steffen@infineon.com \
    --cc=stable@vger.kernel.org \
    --cc=tpmdd-devel@lists.sourceforge.net \
    --subject='Re: [PATCH RESEND 1/2] tpm-dev-common: Reject too short writes' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).