Patch "tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer" has been added to the 6.9-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer

to the 6.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tpm_tis_spi-account-for-spi-header-when-allocating-t.patch
and it can be found in the queue-6.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit cfe71aa3d4babf30fb467c45b31309bdd13bbd60
Author: Matthew R. Ochs <mochs@xxxxxxxxxx>
Date:   Wed May 22 15:06:40 2024 +0300

    tpm_tis_spi: Account for SPI header when allocating TPM SPI xfer buffer
    
    [ Upstream commit 195aba96b854dd664768f382cd1db375d8181f88 ]
    
    The TPM SPI transfer mechanism uses MAX_SPI_FRAMESIZE for computing the
    maximum transfer length and the size of the transfer buffer. As such, it
    does not account for the 4 bytes of header that prepends the SPI data
    frame. This can result in out-of-bounds accesses and was confirmed with
    KASAN.
    
    Introduce SPI_HDRSIZE to account for the header and use to allocate the
    transfer buffer.
    
    Fixes: a86a42ac2bd6 ("tpm_tis_spi: Add hardware wait polling")
    Signed-off-by: Matthew R. Ochs <mochs@xxxxxxxxxx>
    Tested-by: Carol Soto <csoto@xxxxxxxxxx>
    Reviewed-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
    Signed-off-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/char/tpm/tpm_tis_spi_main.c b/drivers/char/tpm/tpm_tis_spi_main.c
index 3f9eaf27b41b8..c9eca24bbad47 100644
--- a/drivers/char/tpm/tpm_tis_spi_main.c
+++ b/drivers/char/tpm/tpm_tis_spi_main.c
@@ -37,6 +37,7 @@
 #include "tpm_tis_spi.h"
 
 #define MAX_SPI_FRAMESIZE 64
+#define SPI_HDRSIZE 4
 
 /*
  * TCG SPI flow control is documented in section 6.4 of the spec[1]. In short,
@@ -247,7 +248,7 @@ static int tpm_tis_spi_write_bytes(struct tpm_tis_data *data, u32 addr,
 int tpm_tis_spi_init(struct spi_device *spi, struct tpm_tis_spi_phy *phy,
 		     int irq, const struct tpm_tis_phy_ops *phy_ops)
 {
-	phy->iobuf = devm_kmalloc(&spi->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL);
+	phy->iobuf = devm_kmalloc(&spi->dev, SPI_HDRSIZE + MAX_SPI_FRAMESIZE, GFP_KERNEL);
 	if (!phy->iobuf)
 		return -ENOMEM;