From patchwork Thu Feb 16 19:25:14 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarkko Sakkinen X-Patchwork-Id: 728882 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3vPR2l6FKjz9s85 for ; Fri, 17 Feb 2017 06:25:51 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=sfs-ml-1.v29.ch3.sourceforge.com) by sfs-ml-1.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1ceRgZ-0002s9-4V; Thu, 16 Feb 2017 19:25:47 +0000 Received: from sog-mx-3.v43.ch3.sourceforge.com ([172.29.43.193] helo=mx.sourceforge.net) by sfs-ml-1.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1ceRgY-0002rw-C6 for tpmdd-devel@lists.sourceforge.net; Thu, 16 Feb 2017 19:25:46 +0000 X-ACL-Warn: Received: from mga09.intel.com ([134.134.136.24]) by sog-mx-3.v43.ch3.sourceforge.com with esmtps (TLSv1:AES256-SHA:256) (Exim 4.76) id 1ceRgX-0000JW-6P for tpmdd-devel@lists.sourceforge.net; Thu, 16 Feb 2017 19:25:46 +0000 Received: from orsmga001.jf.intel.com ([10.7.209.18]) by orsmga102.jf.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 16 Feb 2017 11:25:39 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos; i="5.35,169,1484035200"; d="scan'208"; a="1096542100" Received: from mvesteri-mobl1.ger.corp.intel.com (HELO localhost) ([10.252.27.48]) by orsmga001.jf.intel.com with ESMTP; 16 Feb 2017 11:25:35 -0800 From: Jarkko Sakkinen To: tpmdd-devel@lists.sourceforge.net Date: Thu, 16 Feb 2017 21:25:14 +0200 Message-Id: <20170216192529.25467-2-jarkko.sakkinen@linux.intel.com> X-Mailer: git-send-email 2.9.3 In-Reply-To: <20170216192529.25467-1-jarkko.sakkinen@linux.intel.com> References: <20170216192529.25467-1-jarkko.sakkinen@linux.intel.com> X-Spam-Score: -0.0 (/) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain X-Headers-End: 1ceRgX-0000JW-6P Cc: dhowells@redhat.com, open list , James.Bottomley@HansenPartnership.com, linux-security-module@vger.kernel.org Subject: [tpmdd-devel] [PATCH v2 1/7] tpm: move length validation to tpm_transmit() X-BeenThere: tpmdd-devel@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: Tpm Device Driver maintainance List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: tpmdd-devel-bounces@lists.sourceforge.net Check that the length matches the length reported by the response header already in tpm_transmit() to improve validation. Signed-off-by: Jarkko Sakkinen --- drivers/char/tpm/tpm-interface.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index bd2128e..708d356 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -343,6 +343,7 @@ EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration); ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz, unsigned int flags) { + const struct tpm_output_header *header = (void *)buf; ssize_t rc; u32 count, ordinal; unsigned long stop; @@ -406,9 +407,18 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz, out_recv: rc = chip->ops->recv(chip, (u8 *) buf, bufsiz); - if (rc < 0) + if (rc < 0) { dev_err(&chip->dev, "tpm_transmit: tpm_recv: error %zd\n", rc); + goto out; + } else if (rc < TPM_HEADER_SIZE) { + rc = -EFAULT; + goto out; + } + + if (rc != be32_to_cpu(header->length)) + goto out; + out: if (chip->dev.parent) pm_runtime_put_sync(chip->dev.parent); @@ -438,19 +448,13 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *buf, size_t bufsiz, size_t min_rsp_body_length, unsigned int flags, const char *desc) { - const struct tpm_output_header *header; + const struct tpm_output_header *header = buf; int err; ssize_t len; len = tpm_transmit(chip, (const u8 *)buf, bufsiz, flags); if (len < 0) return len; - else if (len < TPM_HEADER_SIZE) - return -EFAULT; - - header = buf; - if (len != be32_to_cpu(header->length)) - return -EFAULT; err = be32_to_cpu(header->return_code); if (err != 0 && desc)