• Jarkko Sakkinen's avatar
    tpm/tpm_crb: Avoid unaligned reads in crb_recv() · 3d7a850f
    Jarkko Sakkinen authored
    The current approach to read first 6 bytes from the response and then tail
    of the response, can cause the 2nd memcpy_fromio() to do an unaligned read
    (e.g. read 32-bit word from address aligned to a 16-bits), depending on how
    memcpy_fromio() is implemented. If this happens, the read will fail and the
    memory controller will fill the read with 1's.
    
    This was triggered by 170d13ca, which should be probably refined to
    check and react to the address alignment. Before that commit, on x86
    memcpy_fromio() turned out to be memcpy(). By a luck GCC has done the right
    thing (from tpm_crb's perspective) for us so far, but we should not rely on
    that. Thus, it makes sense to fix this also in tpm_crb, not least because
    the fix can be then backported to stable kernels and make them more robust
    when compiled in differing environments.
    
    Cc: stable@vger.kernel.org
    Cc: James Morris <jmorris@namei.org>
    Cc: Tomas Winkler <tomas.winkler@intel.com>
    Cc: Jerry Snitselaar <jsnitsel@redhat.com>
    Fixes: 30fc8d13 ("tpm: TPM 2.0 CRB Interface")
    Signed-off-by: default avatarJarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    Reviewed-by: default avatarJerry Snitselaar <jsnitsel@redhat.com>
    Acked-by: default avatarTomas Winkler <tomas.winkler@intel.com>
    3d7a850f
tpm_crb.c 16.8 KB