From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752722AbcGTAQy (ORCPT ); Tue, 19 Jul 2016 20:16:54 -0400 Received: from mga03.intel.com ([134.134.136.65]:59275 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752082AbcGTAQx (ORCPT ); Tue, 19 Jul 2016 20:16:53 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.28,391,1464678000"; d="scan'208";a="1025162806" From: Jarkko Sakkinen To: Peter Huewe Cc: linux-security-module@vger.kernel.org, Jarkko Sakkinen , Marcel Selhorst , Jason Gunthorpe , tpmdd-devel@lists.sourceforge.net (moderated list:TPM DEVICE DRIVER), linux-kernel@vger.kernel.org (open list) Subject: [PATCH] tpm: fix a race condition tpm2_unseal_trusted() Date: Wed, 20 Jul 2016 03:16:32 +0300 Message-Id: <1468973792-17598-1-git-send-email-jarkko.sakkinen@linux.intel.com> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Unseal and load operations should be done as an atomic unit. This commit fixes the issue by moving TPM mutex handling to tpm_try_get_ops() and tpm_put_ops(), which is probably more logical place for it anyway. Fixes: 954650efb79f ("tpm: seal/unseal for TPM 2.0") Signed-off-by: Jarkko Sakkinen --- drivers/char/tpm/tpm-chip.c | 2 ++ drivers/char/tpm/tpm-interface.c | 3 --- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index e595013..9749f59 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -56,6 +56,7 @@ int tpm_try_get_ops(struct tpm_chip *chip) if (!chip->ops) goto out_lock; + mutex_lock(&chip->tpm_mutex); return 0; out_lock: up_read(&chip->ops_sem); @@ -73,6 +74,7 @@ EXPORT_SYMBOL_GPL(tpm_try_get_ops); */ void tpm_put_ops(struct tpm_chip *chip) { + mutex_unlock(&chip->tpm_mutex); up_read(&chip->ops_sem); put_device(&chip->dev); } diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index 1abe2d7..a2a9c36 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -350,8 +350,6 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf, return -E2BIG; } - mutex_lock(&chip->tpm_mutex); - rc = chip->ops->send(chip, (u8 *) buf, count); if (rc < 0) { dev_err(&chip->dev, @@ -393,7 +391,6 @@ out_recv: dev_err(&chip->dev, "tpm_transmit: tpm_recv: error %zd\n", rc); out: - mutex_unlock(&chip->tpm_mutex); return rc; } -- 2.7.4 From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jarkko Sakkinen Subject: [PATCH] tpm: fix a race condition tpm2_unseal_trusted() Date: Wed, 20 Jul 2016 03:16:32 +0300 Message-ID: <1468973792-17598-1-git-send-email-jarkko.sakkinen@linux.intel.com> Return-path: Sender: owner-linux-security-module@vger.kernel.org To: Peter Huewe Cc: linux-security-module@vger.kernel.org, Jarkko Sakkinen , Marcel Selhorst , Jason Gunthorpe , "moderated list:TPM DEVICE DRIVER" , open list List-Id: tpmdd-devel@lists.sourceforge.net Unseal and load operations should be done as an atomic unit. This commit fixes the issue by moving TPM mutex handling to tpm_try_get_ops() and tpm_put_ops(), which is probably more logical place for it anyway. Fixes: 954650efb79f ("tpm: seal/unseal for TPM 2.0") Signed-off-by: Jarkko Sakkinen --- drivers/char/tpm/tpm-chip.c | 2 ++ drivers/char/tpm/tpm-interface.c | 3 --- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index e595013..9749f59 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -56,6 +56,7 @@ int tpm_try_get_ops(struct tpm_chip *chip) if (!chip->ops) goto out_lock; + mutex_lock(&chip->tpm_mutex); return 0; out_lock: up_read(&chip->ops_sem); @@ -73,6 +74,7 @@ EXPORT_SYMBOL_GPL(tpm_try_get_ops); */ void tpm_put_ops(struct tpm_chip *chip) { + mutex_unlock(&chip->tpm_mutex); up_read(&chip->ops_sem); put_device(&chip->dev); } diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index 1abe2d7..a2a9c36 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -350,8 +350,6 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf, return -E2BIG; } - mutex_lock(&chip->tpm_mutex); - rc = chip->ops->send(chip, (u8 *) buf, count); if (rc < 0) { dev_err(&chip->dev, @@ -393,7 +391,6 @@ out_recv: dev_err(&chip->dev, "tpm_transmit: tpm_recv: error %zd\n", rc); out: - mutex_unlock(&chip->tpm_mutex); return rc; } -- 2.7.4