kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/char
History
Alexander Steffen 60ade6ae6e tpm-dev-common: Reject too short writes 
commit ee70bc1e7b upstream.

tpm_transmit() does not offer an explicit interface to indicate the number
of valid bytes in the communication buffer. Instead, it relies on the
commandSize field in the TPM header that is encoded within the buffer.
Therefore, ensure that a) enough data has been written to the buffer, so
that the commandSize field is present and b) the commandSize field does not
announce more data than has been written to the buffer.

This should have been fixed with CVE-2011-1161 long ago, but apparently
a correct version of that patch never made it into the kernel.

Signed-off-by: Alexander Steffen <Alexander.Steffen@infineon.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
[bwh: Backported to 3.16: adjust filename, context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-02-13 18:42:08 +00:00
..
agp agp/intel: Fix typo in needs_ilk_vtd_wa() 2015-07-15 10:00:58 +01:00
hw_random hwrng: core - Don't use a stack buffer in add_early_randomness() 2017-02-23 03:54:17 +00:00
ipmi ipmi: fix unsigned long underflow 2018-02-13 18:42:03 +00:00
mwave drivers/char: delete non-required instances of include <linux/init.h> 2014-02-07 15:10:19 -08:00
pcmcia tty: Fix help text of SYNCLINK_CS 2014-04-16 14:31:13 -07:00
tpm tpm-dev-common: Reject too short writes 2018-02-13 18:42:08 +00:00
xilinx_hwicap char: hwicap: Remove unnecessary dev_set_drvdata() 2013-10-03 16:03:31 -07:00
apm-emulation.c apm-emulation: add hibernation APM events to support suspend2disk 2014-01-07 13:50:28 +01:00
applicom.c applicom: dereferencing NULL on error path 2014-05-27 17:43:12 -07:00
applicom.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
bfin-otp.c llseek: automatically add .llseek fop 2010-10-15 15:53:27 +02:00
bsr.c drivers: clean-up prom.h implicit includes 2013-10-09 20:04:04 -05:00
ds1302.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
ds1620.c ds1620: single_open() leak 2013-05-05 00:11:29 -04:00
dsp56k.c new helper: file_inode(file) 2013-02-22 23:31:31 -05:00
dtlk.c new helper: file_inode(file) 2013-02-22 23:31:31 -05:00
efirtc.c rtc: single_open() leaks 2013-05-05 00:12:29 -04:00
generic_nvram.c drivers: fix up various ->llseek() implementations 2011-07-20 20:47:58 -04:00
genrtc.c rtc: single_open() leaks 2013-05-05 00:12:29 -04:00
hangcheck-timer.c Input: sysrq - drop tty argument form handle_sysrq() 2010-08-21 00:34:45 -07:00
hpet.c ACPI: Clean up inclusions of ACPI header files 2013-12-07 01:03:14 +01:00
i8k.c hwmon: (dell-smm) Restrict fan control and serial number to CAP_SYS_ADMIN by default 2016-08-22 22:38:16 +01:00
Kconfig char: Drop bogus dependency of DEVPORT on !M68K 2016-08-22 22:37:53 +01:00
lp.c char: lp: fix possible integer overflow in lp_setup() 2017-07-18 18:40:40 +01:00
Makefile Merge branch 'drm-next' of git://people.freedesktop.org/~airlied/linux 2014-01-29 20:49:12 -08:00
mbcs.c char: remove use of __devinitconst 2012-11-21 12:55:19 -08:00
mbcs.h Fix common misspellings 2011-03-31 11:26:23 -03:00
mem.c drivers: char: mem: Fix wraparound check to allow mappings up to the end 2017-09-15 18:29:55 +01:00
misc.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2013-11-13 15:34:18 +09:00
mmtimer.c drivers/char/mmtimer.c: Remove useless kfree 2012-09-26 13:20:40 -07:00
msm_smd_pkt.c treewide: Fix typos in printk 2013-12-19 15:10:49 +01:00
mspec.c char: Use vma_pages() to replace (vm_end - vm_start) >> PAGE_SHIFT 2013-05-21 10:07:54 -07:00
nsc_gpio.c new helper: file_inode(file) 2013-02-22 23:31:31 -05:00
nvram.c Remove all #inclusions of asm/system.h 2012-03-28 18:30:03 +01:00
nwbutton.c char: nwbutton: open-code interruptible_sleep_on 2014-01-08 15:29:52 -08:00
nwbutton.h IRQ: Maintain regs pointer globally rather than passing to IRQ handlers 2006-10-05 15:10:12 +01:00
nwflash.c Merge branch 'late/fixes' into fixes 2012-10-07 07:22:32 -07:00
pc8736x_gpio.c pc8736x_gpio: use platform_device_unregister in pc8736x_gpio_cleanup() 2012-10-24 15:52:29 -07:00
ppdev.c new helper: file_inode(file) 2013-02-22 23:31:31 -05:00
ps3flash.c ps3flash: switch to generic_file_llseek_size() 2013-06-29 12:57:33 +04:00
random.c random: add interrupt callback to VMBus IRQ handler 2016-11-20 01:16:40 +00:00
raw.c blkdev_aio_write() - turn into blkdev_write_iter() 2014-05-06 17:38:01 -04:00
rtc.c various char drivers: remove deprecated IRQF_DISABLED 2013-10-16 12:36:10 -07:00
scx200_gpio.c llseek: automatically add .llseek fop 2010-10-15 15:53:27 +02:00
snsc.c various char drivers: remove deprecated IRQF_DISABLED 2013-10-16 12:36:10 -07:00
snsc.h headers: kobject.h redux 2011-01-10 08:51:44 -08:00
snsc_event.c various char drivers: remove deprecated IRQF_DISABLED 2013-10-16 12:36:10 -07:00
sonypi.c ACPI: Remove the old /proc/acpi/event interface 2013-07-15 13:56:36 +02:00
tb0219.c new helper: file_inode(file) 2013-02-22 23:31:31 -05:00
tile-srom.c drivers/char: delete non-required instances of include <linux/init.h> 2014-02-07 15:10:19 -08:00
tlclk.c tlclk: remove deprecated IRQF_DISABLED 2013-10-16 12:36:10 -07:00
toshiba.c Merge branch 'llseek' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/bkl 2010-10-22 10:52:56 -07:00
ttyprintk.c ttyprintk: Allow built as a module 2014-04-16 14:21:06 -07:00
uv_mmtimer.c BKL: remove extraneous #include <smp_lock.h> 2010-11-17 08:59:32 -08:00
virtio_console.c virtio_console: fix uninitialized variable use 2017-07-18 18:40:32 +01:00