All of lore.kernel.org
 help / color / mirror / Atom feed
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: linux-integrity@vger.kernel.org
Cc: linux-security-module@vger.kernel.org,
	Peter Huewe <PeterHuewe@gmx.de>, Jason Gunthorpe <jgg@ziepe.ca>,
	Tomas Winkler <tomas.winkler@intel.com>,
	Tadeusz Struk <tadeusz.struk@intel.com>,
	Stefan Berger <stefanb@linux.vnet.ibm.com>,
	Nayna Jain <nayna@linux.ibm.com>,
	Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>,
	James Bottomley <James.Bottomley@HansenPartnership.com>,
	stable@vger.kernel.org
Subject: [PATCH v10 08/17] tpm: call tpm2_flush_space() on error in tpm_try_transmit()
Date: Wed, 16 Jan 2019 23:23:33 +0200	[thread overview]
Message-ID: <20190116212342.24524-9-jarkko.sakkinen@linux.intel.com> (raw)
In-Reply-To: <20190116212342.24524-1-jarkko.sakkinen@linux.intel.com>

Always call tpm2_flush_space() on failure in tpm_try_transmit() so that
the volatile memory of the TPM gets cleared. If /dev/tpm0 does not have
sufficient permissions (usually it has), this could lead to the leakage
of TPM objects. Through /dev/tpmrm0 this issue does not raise any new
security concerns.

Cc: James Bottomley <James.Bottomley@HansenPartnership.com>
Cc: stable@vger.kernel.org
Fixes: 745b361e989a ("tpm:tpm: infrastructure for TPM spaces")
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Tested-by: Stefan Berger <stefanb@linux.ibm.com>
---
 drivers/char/tpm/tpm-interface.c | 29 ++++++++++++-----------------
 drivers/char/tpm/tpm.h           |  1 +
 drivers/char/tpm/tpm2-space.c    |  2 +-
 3 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index 689d07e67643..2c409d19a9b9 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -220,14 +220,14 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip, struct tpm_space *space,
 
 	rc = tpm2_prepare_space(chip, space, ordinal, buf);
 	if (rc)
-		goto out;
+		goto out_idle;
 
 	rc = chip->ops->send(chip, buf, count);
 	if (rc < 0) {
 		if (rc != -EPIPE)
 			dev_err(&chip->dev,
 				"%s: tpm_send: error %d\n", __func__, rc);
-		goto out;
+		goto out_space;
 	}
 
 	if (chip->flags & TPM_CHIP_FLAG_IRQ)
@@ -243,7 +243,7 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip, struct tpm_space *space,
 		if (chip->ops->req_canceled(chip, status)) {
 			dev_err(&chip->dev, "Operation Canceled\n");
 			rc = -ECANCELED;
-			goto out;
+			goto out_space;
 		}
 
 		tpm_msleep(TPM_TIMEOUT_POLL);
@@ -253,28 +253,23 @@ static ssize_t tpm_try_transmit(struct tpm_chip *chip, struct tpm_space *space,
 	chip->ops->cancel(chip);
 	dev_err(&chip->dev, "Operation Timed out\n");
 	rc = -ETIME;
-	goto out;
+	goto out_space;
 
 out_recv:
 	len = chip->ops->recv(chip, buf, bufsiz);
 	if (len < 0) {
 		rc = len;
-		dev_err(&chip->dev,
-			"tpm_transmit: tpm_recv: error %d\n", rc);
-		goto out;
-	} else if (len < TPM_HEADER_SIZE) {
+		dev_err(&chip->dev, "tpm_transmit: tpm_recv: error %d\n", rc);
+	} else if (len < TPM_HEADER_SIZE || len != be32_to_cpu(header->length))
 		rc = -EFAULT;
-		goto out;
-	}
 
-	if (len != be32_to_cpu(header->length)) {
-		rc = -EFAULT;
-		goto out;
-	}
-
-	rc = tpm2_commit_space(chip, space, ordinal, buf, &len);
+out_space:
+	if (rc)
+		tpm2_flush_space(chip);
+	else
+		rc = tpm2_commit_space(chip, space, ordinal, buf, &len);
 
-out:
+out_idle:
 	/* may fail but do not override previous error value in rc */
 	tpm_go_idle(chip, flags);
 
diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
index 1454ef19d2f4..6eb67ccad2a3 100644
--- a/drivers/char/tpm/tpm.h
+++ b/drivers/char/tpm/tpm.h
@@ -576,6 +576,7 @@ int tpm2_probe(struct tpm_chip *chip);
 int tpm2_find_cc(struct tpm_chip *chip, u32 cc);
 int tpm2_init_space(struct tpm_space *space);
 void tpm2_del_space(struct tpm_chip *chip, struct tpm_space *space);
+void tpm2_flush_space(struct tpm_chip *chip);
 int tpm2_prepare_space(struct tpm_chip *chip, struct tpm_space *space, u32 cc,
 		       u8 *cmd);
 int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space,
diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
index 39cb3915771e..5d6487575074 100644
--- a/drivers/char/tpm/tpm2-space.c
+++ b/drivers/char/tpm/tpm2-space.c
@@ -162,7 +162,7 @@ static int tpm2_save_context(struct tpm_chip *chip, u32 handle, u8 *buf,
 	return 0;
 }
 
-static void tpm2_flush_space(struct tpm_chip *chip)
+void tpm2_flush_space(struct tpm_chip *chip)
 {
 	struct tpm_space *space = &chip->work_space;
 	int i;
-- 
2.19.1


  parent reply	other threads:[~2019-01-16 21:24 UTC|newest]

Thread overview: 33+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-01-16 21:23 [PATCH v10 00/17] Remove nested TPM operations Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 01/17] tpm: use tpm_buf in tpm_transmit_cmd() as the IO parameter Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 02/17] tpm: fix invalid return value in pubek_show() Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 03/17] tpm: return 0 from pcrs_show() when tpm1_pcr_read() fails Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 04/17] tpm: print tpm2_commit_space() error inside tpm2_commit_space() Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 05/17] tpm: declare struct tpm_header Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 06/17] tpm: access command header through struct in tpm_try_transmit() Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 07/17] tpm: encapsulate tpm_dev_transmit() Jarkko Sakkinen
2019-01-16 21:23 ` Jarkko Sakkinen [this message]
2019-01-29 17:06   ` [PATCH v10 08/17] tpm: call tpm2_flush_space() on error in tpm_try_transmit() James Bottomley
2019-01-29 18:53     ` Jarkko Sakkinen
2019-01-29 19:02       ` James Bottomley
2019-01-29 21:11         ` Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 09/17] tpm: clean up tpm_try_transmit() error handling flow Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 10/17] tpm: move tpm_validate_commmand() to tpm2-space.c Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 11/17] tpm: move TPM space code out of tpm_transmit() Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 12/17] tpm: remove @space from tpm_transmit() Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 13/17] tpm: use tpm_try_get_ops() in tpm-sysfs.c Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 14/17] tpm: remove TPM_TRANSMIT_UNLOCKED flag Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 15/17] tpm: introduce tpm_chip_start() and tpm_chip_stop() Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 16/17] tpm: take TPM chip power gating out of tpm_transmit() Jarkko Sakkinen
2019-01-16 21:23 ` [PATCH v10 17/17] tpm: remove @flags from tpm_transmit() Jarkko Sakkinen
2019-01-23 18:20 ` [PATCH v10 00/17] Remove nested TPM operations Jarkko Sakkinen
2019-01-23 18:53   ` Stefan Berger
2019-01-23 18:59     ` Winkler, Tomas
2019-01-29 12:33       ` Jarkko Sakkinen
2019-01-29 14:16         ` Winkler, Tomas
2019-01-29 18:30           ` Jarkko Sakkinen
2019-01-29 12:31     ` Jarkko Sakkinen
2019-01-31  0:28       ` James Bottomley
2019-01-31 16:11         ` Jarkko Sakkinen
2019-01-25  1:05 ` Jerry Snitselaar
2019-01-29 12:33   ` Jarkko Sakkinen

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190116212342.24524-9-jarkko.sakkinen@linux.intel.com \
    --to=jarkko.sakkinen@linux.intel.com \
    --cc=James.Bottomley@HansenPartnership.com \
    --cc=PeterHuewe@gmx.de \
    --cc=jgg@ziepe.ca \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-security-module@vger.kernel.org \
    --cc=nayna@linux.ibm.com \
    --cc=stable@vger.kernel.org \
    --cc=stefanb@linux.vnet.ibm.com \
    --cc=tadeusz.struk@intel.com \
    --cc=tomas.winkler@intel.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.