On Wed, Apr 10, 2019 at 04:54:32PM +0300, Jarkko Sakkinen wrote:
> commit 3d7a850fdc1a2e4d2adbc95cc0fc962974725e88 upstream
>
> The current approach to read first 6 bytes from the response and then tail
> of the response, can cause the 2nd memcpy_fromio() to do an unaligned read
> (e.g. read 32-bit word from address aligned to a 16-bits), depending on how
> memcpy_fromio() is implemented. If this happens, the read will fail and the
> memory controller will fill the read with 1's.
>
> This was triggered by 170d13ca3a2f, which should be probably refined to
> check and react to the address alignment. Before that commit, on x86
> memcpy_fromio() turned out to be memcpy(). By a luck GCC has done the right
> thing (from tpm_crb's perspective) for us so far, but we should not rely on
> that. Thus, it makes sense to fix this also in tpm_crb, not least because
> the fix can be then backported to stable kernels and make them more robust
> when compiled in differing environments.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Cc: James Morris <jmorris@xxxxxxxxx>
> Cc: Tomas Winkler <tomas.winkler@xxxxxxxxx>
> Cc: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>
> Fixes: 30fc8d138e91 ("tpm: TPM 2.0 CRB Interface")
> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@xxxxxxxxxxxxxxx>
> Reviewed-by: Jerry Snitselaar <jsnitsel@xxxxxxxxxx>
> Acked-by: Tomas Winkler <tomas.winkler@xxxxxxxxx>
> ---
> backport v4.4.178
> drivers/char/tpm/tpm_crb.c | 22 ++++++++++++++++------
> 1 file changed, 16 insertions(+), 6 deletions(-)
I need a 4.9.y version first before I can take a 4.4.y version, as we do
not want anyone to have a regression moving from 4.4.y to a newer
kernel.
thanks,
greg k-h
