tpm-dev-common: Reject too short writes

[mirror_ubuntu-bionic-kernel.git] / drivers / char / tpm / tpm-dev-common.c

diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c
index 610638a80383d4a104a6fe1ec42479722f222f49..461bf0b8a09473dbadc89b9259473dc36be2cd77 100644 (file)
--- a/drivers/char/tpm/tpm-dev-common.c
+++ b/drivers/char/tpm/tpm-dev-common.c
@@ -110,6 +110,12 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf,
                return -EFAULT;
        }
 
+       if (in_size < 6 ||
+           in_size < be32_to_cpu(*((__be32 *) (priv->data_buffer + 2)))) {
+               mutex_unlock(&priv->buffer_mutex);
+               return -EINVAL;
+       }
+
        /* atomic tpm command send and result receive. We only hold the ops
         * lock during this period so that the tpm can be unregistered even if
         * the char dev is held open.