linux-kernel - Re: [PATCH] TPM: Fixup pcrs sysfs file

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 3 Sep 2009 16:52:19 -0700
From:	Andrew Morton <akpm@...ux-foundation.org>
To:	Jason Gunthorpe <jgunthorpe@...idianresearch.com>
Cc:	tpmdd-devel@...ts.sourceforge.net, linux-kernel@...r.kernel.org,
	srajiv@...ux.vnet.ibm.com,
	Debora Velarde <debora@...ux.vnet.ibm.com>,
	Marcel Selhorst <m.selhorst@...rix.com>,
	James Morris <jmorris@...ei.org>,
	Jan Beulich <jbeulich@...ell.com>
Subject: Re: [PATCH] TPM: Fixup pcrs sysfs file

On Tue, 1 Sep 2009 21:16:13 -0600
Jason Gunthorpe <jgunthorpe@...idianresearch.com> wrote:

> I'm testing the tpm_tis low level driver with a winbond WPCT200:
> $ cat caps
> Manufacturer: 0x57454300
> TCG version: 1.2
> Firmware version: 2.16
> 
> and noted that tpm_pcr_read for the pcrs sysfile file does not function.
> tpm_tis_recv returned with an error because the expected reply size was
> set to 14 (the request size) and the chip returned 30 bytes.
> 
> The TCG spec says the reply size is supposed to be 30 bytes.
> 
> First, the BUILD_BUG_ON was surely never correct, testing a run time
> value in big endian with that macro is just wrong. I belive the intended
> test was to ensure that the cmd buffer has enough space to store the
> reply.
> 
> Second, the length input to transmit_cmd is the size of the reply, not
> of the request. It should be 30 for READ_PCR.
> 
> With this change my chip reports all 23 pcrs.
> 
> Signed-off-by: Jason Gunthorpe <jgunthorpe@...idianresearch.com>
> ---
>  drivers/char/tpm/tpm.c |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
> index a6b52d6..8ba0187 100644
> --- a/drivers/char/tpm/tpm.c
> +++ b/drivers/char/tpm/tpm.c
> @@ -696,8 +696,8 @@ int __tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, u8 *res_buf)
>  
>  	cmd.header.in = pcrread_header;
>  	cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
> -	BUILD_BUG_ON(cmd.header.in.length > READ_PCR_RESULT_SIZE);
> -	rc = transmit_cmd(chip, &cmd, cmd.header.in.length,
> +	BUILD_BUG_ON(sizeof(cmd) < READ_PCR_RESULT_SIZE);
> +	rc = transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE,
>  			  "attempting to read a pcr value");
>  
>  	if (rc == 0)

That sounds like a fairly serious bug, and this looks like a 2.6.31
patch.

Jan's build_bug_on-fix-it-and-a-couple-of-bogus-uses-of-it.patch (in
-mm) simply removes the bogus BUILD_BUG_ON(). I think we might as well
do that within the context of your patch.

So I end up with the below, which I propose for 2.6.31:



From: Jason Gunthorpe <jgunthorpe@...idianresearch.com>

I'm testing the tpm_tis low level driver with a winbond WPCT200:

$ cat caps
Manufacturer: 0x57454300
TCG version: 1.2
Firmware version: 2.16

and noted that tpm_pcr_read for the pcrs sysfile file does not function. 
tpm_tis_recv returned with an error because the expected reply size was
set to 14 (the request size) and the chip returned 30 bytes.

The TCG spec says the reply size is supposed to be 30 bytes.

The length input to transmit_cmd is the size of the reply, not of the
request.  It should be 30 for READ_PCR.

With this change my chip reports all 23 pcrs.

Also, the BUILD_BUG_ON() is just wrong - it's testing a value which isn't
a compile-time constant.  Simply remove that assertion.

Signed-off-by: Jason Gunthorpe <jgunthorpe@...idianresearch.com>
Cc: Debora Velarde <debora@...ux.vnet.ibm.com>
Cc: Rajiv Andrade <srajiv@...ux.vnet.ibm.com>
Cc: Marcel Selhorst <m.selhorst@...rix.com>
Cc: James Morris <jmorris@...ei.org>
Signed-off-by: Andrew Morton <akpm@...ux-foundation.org>
---

 drivers/char/tpm/tpm.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff -puN drivers/char/tpm/tpm.c~tpm-fixup-pcrs-sysfs-file drivers/char/tpm/tpm.c
--- a/drivers/char/tpm/tpm.c~tpm-fixup-pcrs-sysfs-file
+++ a/drivers/char/tpm/tpm.c
@@ -696,8 +696,7 @@ int __tpm_pcr_read(struct tpm_chip *chip
 
 	cmd.header.in = pcrread_header;
 	cmd.params.pcrread_in.pcr_idx = cpu_to_be32(pcr_idx);
-	BUILD_BUG_ON(cmd.header.in.length > READ_PCR_RESULT_SIZE);
-	rc = transmit_cmd(chip, &cmd, cmd.header.in.length,
+	rc = transmit_cmd(chip, &cmd, READ_PCR_RESULT_SIZE,,
 			  "attempting to read a pcr value");
 
 	if (rc == 0)
_

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/