Jerry Snitselaar 63450e38ef tpm_crb: check for bad response size ...

commit 8569defde8 upstream.

Make sure size of response buffer is at least 6 bytes, or
we will underflow and pass large size_t to memcpy_fromio().
This was encountered while testing earlier version of
locality patchset.

Fixes: 30fc8d138e ("tpm: TPM 2.0 CRB Interface")
Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-05-25 14:30:07 +02:00

..

agp

agp/uninorth: fix a memleak in create_gatt_table

2015-10-02 22:57:59 +10:00

hw_random

hwrng: core - Don't use a stack buffer in add_early_randomness()

2016-11-18 10:48:36 +01:00

ipmi

ipmi: Fix kernel panic at ipmi_ssif_thread()

2017-05-20 14:27:03 +02:00

mwave

drivers/char: delete non-required instances of include <linux/init.h>

2014-02-07 15:10:19 -08:00

pcmcia

tty: Remove ASYNC_CLOSING checks in open()/hangup() methods

2015-10-17 21:11:29 -07:00

tpm

tpm_crb: check for bad response size

2017-05-25 14:30:07 +02:00

xilinx_hwicap

char:xilinx_hwicap:buffer_icap - change 1/0 to true/false for bool type variable in function buffer_icap_set_configuration().

2015-06-12 16:58:33 -07:00

xillybus

char: xillybus: Allow 64-bit DMA on PCIe interface

2015-08-05 12:27:09 -07:00

apm-emulation.c

apm-emulation: add hibernation APM events to support suspend2disk

2014-01-07 13:50:28 +01:00

applicom.c

applicom: dereferencing NULL on error path

2014-05-27 17:43:12 -07:00

applicom.h

Linux-2.6.12-rc2

2005-04-16 15:20:36 -07:00

bfin-otp.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

bsr.c

bsr: avoid format string leaking into device name

2014-07-09 16:59:15 -07:00

ds1302.c

Remove all #inclusions of asm/system.h

2012-03-28 18:30:03 +01:00

ds1620.c

ds1620: single_open() leak

2013-05-05 00:11:29 -04:00

dsp56k.c

drivers/char/dsp56k.c: drop check for negativity of unsigned parameter

2014-07-17 18:38:37 -07:00

dtlk.c

new helper: file_inode(file)

2013-02-22 23:31:31 -05:00

efirtc.c

drivers/char: make efirtc.c driver explicitly non-modular

2015-09-20 19:32:35 -07:00

generic_nvram.c

drivers: fix up various ->llseek() implementations

2011-07-20 20:47:58 -04:00

genrtc.c

rtc: single_open() leaks

2013-05-05 00:12:29 -04:00

hangcheck-timer.c

hangcheck-timer: cleanup casting in hangcheck_init()

2014-11-07 11:24:01 -08:00

hpet.c

drivers/char: make hpet.c explicitly non-modular

2015-09-20 19:32:35 -07:00

Kconfig

char: lack of bool string made CONFIG_DEVPORT always on

2017-04-21 09:30:06 +02:00

lp.c

char: lp: fix possible integer overflow in lp_setup()

2017-05-25 14:30:07 +02:00

Makefile

hwmon: Rename i8k driver to dell-smm-hwmon and move it to hwmon tree

2015-05-24 12:48:12 -07:00

mbcs.c

char: remove use of __devinitconst

2012-11-21 12:55:19 -08:00

mbcs.h

Fix common misspellings

2011-03-31 11:26:23 -03:00

mem.c

mm: Tighten x86 /dev/mem with zeroing reads

2017-04-21 09:30:07 +02:00

misc.c

char: make misc_deregister a void function

2015-08-05 10:35:49 -07:00

mmtimer.c

drivers/char/mmtimer.c: Remove useless kfree

2012-09-26 13:20:40 -07:00

mspec.c

char: Use vma_pages() to replace (vm_end - vm_start) >> PAGE_SHIFT

2013-05-21 10:07:54 -07:00

nsc_gpio.c

new helper: file_inode(file)

2013-02-22 23:31:31 -05:00

nvram.c

char/nvram: Use bitwise OR to obtain Atari video mode data

2015-08-05 13:30:16 -07:00

nwbutton.c

char: nwbutton: open-code interruptible_sleep_on

2014-01-08 15:29:52 -08:00

nwbutton.h

IRQ: Maintain regs pointer globally rather than passing to IRQ handlers

2006-10-05 15:10:12 +01:00

nwflash.c

Merge branch 'late/fixes' into fixes

2012-10-07 07:22:32 -07:00

pc8736x_gpio.c

pc8736x_gpio: use platform_device_unregister in pc8736x_gpio_cleanup()

2012-10-24 15:52:29 -07:00

ppdev.c

new helper: file_inode(file)

2013-02-22 23:31:31 -05:00

ps3flash.c

ps3flash: switch to generic_file_llseek_size()

2013-06-29 12:57:33 +04:00

random.c

random: add interrupt callback to VMBus IRQ handler

2016-08-20 18:09:20 +02:00

raw.c

writeback: separate out include/linux/backing-dev-defs.h

2015-06-02 08:33:34 -06:00

rtc.c

various char drivers: remove deprecated IRQF_DISABLED

2013-10-16 12:36:10 -07:00

scx200_gpio.c

llseek: automatically add .llseek fop

2010-10-15 15:53:27 +02:00

snsc_event.c

various char drivers: remove deprecated IRQF_DISABLED

2013-10-16 12:36:10 -07:00

snsc.c

drivers/char: make SGI snsc.c driver explicitly non-modular

2015-09-20 19:32:35 -07:00

snsc.h

headers: kobject.h redux

2011-01-10 08:51:44 -08:00

sonypi.c

char: drop owner assignment from platform_drivers

2014-10-20 16:20:19 +02:00

tb0219.c

char: drop owner assignment from platform_drivers

2014-10-20 16:20:19 +02:00

tile-srom.c

fs: move struct kiocb to fs.h

2015-03-25 20:28:11 -04:00

tlclk.c

tlclk: remove deprecated IRQF_DISABLED

2013-10-16 12:36:10 -07:00

toshiba.c

toshiba laptop: replace ioremap_cache with ioremap

2015-08-05 17:26:00 -07:00

ttyprintk.c

ttyprintk: Allow built as a module

2014-04-16 14:21:06 -07:00

uv_mmtimer.c

BKL: remove extraneous #include <smp_lock.h>

2010-11-17 08:59:32 -08:00

virtio_console.c

virtio-console: avoid DMA from stack

2017-04-21 09:30:07 +02:00