linux-kernel - Re: [GIT PULL] TPM driver robustness fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <AANLkTi=+QFL5aMym68Dx=Vgomy9MQRV1AB1AreTua_mW@mail.gmail.com>
Date:	Tue, 22 Mar 2011 17:08:21 +0100
From:	Peter Huewe <huewe.external.infineon@...glemail.com>
To:	Rajiv Andrade <srajiv@...ux.vnet.ibm.com>
Cc:	James Morris <jmorris@...ei.org>,
	Linux kernel mailing list <linux-kernel@...r.kernel.org>
Subject: Re: [GIT PULL] TPM driver robustness fixes

On Tue, Mar 22, 2011 at 2:16 PM, Rajiv Andrade
<srajiv@...ux.vnet.ibm.com> wrote:
> On 03/22/2011 09:58 AM, Peter Huewe wrote:
>>
>>> Consider what happens in memset if copy_to_user fails.
>>
>> Sorry I don't see it. Can you please clearify the problem for me?
>>
> memset() is called with the count parameter being a negative value,
> ret_size=-EFAULT.

You're right - sorry.

Do you prefer a temporary variable like this

diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index d184d75..d3976f5 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1051,7 +1051,7 @@ ssize_t tpm_read(struct file *file, char __user *buf,
                 size_t size, loff_t *off)
 {
        struct tpm_chip *chip = file->private_data;
-       ssize_t ret_size;
+       ssize_t ret_size, tmp_size;

        del_singleshot_timer_sync(&chip->user_read_timer);
        flush_work_sync(&chip->work);
@@ -1061,9 +1061,11 @@ ssize_t tpm_read(struct file *file, char __user *buf,
                if (size < ret_size)
                        ret_size = size;

+               tmp_size = ret_size;
                mutex_lock(&chip->buffer_mutex);
                if (copy_to_user(buf, chip->data_buffer, ret_size))
                        ret_size = -EFAULT;
+               memset(chip->data_buffer, 0, tmp_size);
                mutex_unlock(&chip->buffer_mutex);
        }


Or an if else like this:

diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index d184d75..571c0ca 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1062,8 +1062,12 @@ ssize_t tpm_read(struct file *file, char __user *buf,
                        ret_size = size;

                mutex_lock(&chip->buffer_mutex);
-               if (copy_to_user(buf, chip->data_buffer, ret_size))
+               if (copy_to_user(buf, chip->data_buffer, ret_size)) {
+                       memset(chip->data_buffer, 0, ret_size);
                        ret_size = -EFAULT;
+               } else {
+                       memset(chip->data_buffer, 0, ret_size);
+               }
                mutex_unlock(&chip->buffer_mutex);
        }


Or rather:
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index d184d75..2f2f65e 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -1052,6 +1052,7 @@ ssize_t tpm_read(struct file *file, char __user *buf,
 {
        struct tpm_chip *chip = file->private_data;
        ssize_t ret_size;
+       int rc;

        del_singleshot_timer_sync(&chip->user_read_timer);
        flush_work_sync(&chip->work);
@@ -1062,8 +1063,11 @@ ssize_t tpm_read(struct file *file, char __user *buf,
                        ret_size = size;

                mutex_lock(&chip->buffer_mutex);
-               if (copy_to_user(buf, chip->data_buffer, ret_size))
+               rc = copy_to_user(buf, chip->data_buffer, ret_size);
+               memset(chip->data_buffer, 0, ret_size);
+               if (rc)
                        ret_size = -EFAULT;
+
                mutex_unlock(&chip->buffer_mutex);
        }



Thanks,
Peter
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/