From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752606AbdAUCNG (ORCPT ); Fri, 20 Jan 2017 21:13:06 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:34853 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751028AbdAUCNE (ORCPT ); Fri, 20 Jan 2017 21:13:04 -0500 Subject: Re: [PATCH v7] tpm: Check size of response before accessing data To: Jarkko Sakkinen References: <1484828352-23202-1-git-send-email-stefanb@linux.vnet.ibm.com> <20170120133630.ld5shdqhquxzd7sn@intel.com> <20170120162145.lrdcrf5iw6d6otd3@intel.com> <20170120175522.zsotpu22be3nozbl@intel.com> <20170120201423.aky44svd3vejxxis@intel.com> Cc: tpmdd-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org From: Stefan Berger Date: Fri, 20 Jan 2017 16:04:14 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <20170120201423.aky44svd3vejxxis@intel.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 17012021-0044-0000-0000-0000025618FF X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00006469; HX=3.00000240; KW=3.00000007; PH=3.00000004; SC=3.00000200; SDB=6.00810439; UDB=6.00394925; IPR=6.00587793; BA=6.00005080; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00013991; XFM=3.00000011; UTC=2017-01-20 21:04:21 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17012021-0045-0000-0000-0000068319E4 Message-Id: X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-01-20_12:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1612050000 definitions=main-1701200270 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 01/20/2017 03:14 PM, Jarkko Sakkinen wrote: > On Fri, Jan 20, 2017 at 07:55:22PM +0200, Jarkko Sakkinen wrote: >> On Fri, Jan 20, 2017 at 06:21:58PM +0200, Jarkko Sakkinen wrote: >>> On Fri, Jan 20, 2017 at 03:36:30PM +0200, Jarkko Sakkinen wrote: >>>> On Thu, Jan 19, 2017 at 07:19:12AM -0500, Stefan Berger wrote: >>>>> Make sure that we have not received less bytes than what is indicated >>>>> in the header of the TPM response. Also, check the number of bytes in >>>>> the response before accessing its data. >>>>> >>>>> Signed-off-by: Stefan Berger >>>> Reviewed-by: Jarkko Sakkinen >>> Oops. I found some odd stuff after all so hold on for a moment. >>> I could do these updates myself probably... >>> >>>>> ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd, >>>>> - int len, unsigned int flags, const char *desc) >>>>> + size_t len, size_t min_rsp_body_length, >>>>> + unsigned int flags, const char *desc) >>> BTW, maybe the cmd_length would be actually a better idea because >>> it gets mixes witht local variable. >>> >>>>> { >>>>> const struct tpm_output_header *header; >>>>> int err; >>>>> + ssize_t length; >>> Maybe it would make sense to name this as rsp_length. >>> >>>>> >>>>> - len = tpm_transmit(chip, (const u8 *)cmd, len, flags); >>>>> - if (len < 0) >>>>> - return len; >>>>> - else if (len < TPM_HEADER_SIZE) >>>>> + length = tpm_transmit(chip, (const u8 *)cmd, len, flags); >>>>> + if (length < 0) >>>>> + return length; >>>>> + else if (length < TPM_HEADER_SIZE) >>>>> return -EFAULT; >>>>> >>>>> header = cmd; >>>>> + if (length < be32_to_cpu(header->length)) >>>>> + return -EFAULT; >>> Why '<' and not '!='? In what legit case length would be larger? >>> >>>>> >>>>> err = be32_to_cpu(header->return_code); >>>>> if (err != 0 && desc) >>>>> dev_err(&chip->dev, "A TPM error (%d) occurred %s\n", err, >>>>> desc); >>>>> + if (err) >>>>> + return err; >>>>> >>>>> - return err; >>>>> + if (be32_to_cpu(header->length) < >>>>> + min_rsp_body_length + TPM_HEADER_SIZE) >>>>> + return -EFAULT; >>> Why couldn't you use 'length' here? >>> >>> /Jarkko >> Anyway, >> >> Tested-by: Jarkko Sakkinen > Stefan, I updated the patch by doing '!=' check and renaming parameters > to 'buf' and 'bufsiz' as they are in tpm_transmit(). The current namesd > did not make sense because you pass a buffer that will also will store > the response. > > Can you check that after my updates it looks OK to you? LGTM. The != you introduced is correct (and stricter).