linux-kernel - Re: [tpmdd-devel] [PATCH v2] tpm: introduce struct tpm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 9 Jun 2015 15:05:33 +0300
From:	Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
To:	Peter Huewe <peterhuewe@....de>
Cc:	"moderated list:TPM DEVICE DRIVER" 
	<tpmdd-devel@...ts.sourceforge.net>, safford@...ibm.com,
	open list <linux-kernel@...r.kernel.org>
Subject: Re: [tpmdd-devel] [PATCH v2] tpm: introduce struct tpm_buf

On Tue, Jun 09, 2015 at 01:58:59PM +0200, Peter Huewe wrote:
> 
> 
> Am 9. Juni 2015 13:39:13 MESZ, schrieb Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>:
> >On Tue, Jun 09, 2015 at 12:32:57PM +0200, Peter Huewe wrote:
> >> 
> >> 
> >> Hi
> >> 
> >> >> > +static inline void tpm_buf_store(struct tpm_buf *buf,
> >> >> > +				 unsigned int pos,
> >> >> > +				 const unsigned char *data,
> >> >> > +				 unsigned int len)
> >> >> > +{
> >> >> > +	BUG_ON((pos + len) > TPM_BUF_SIZE);
> >> >> > +
> >> >> > +	memcpy(&buf->data[pos], data, len);
> >> >> > +}
> >> >> 
> >> >> Don't you have to update the ->length here?
> >> >
> >> >No. Store is for placing value in position, not appending to the
> >end.
> >> >
> >> Then either add a length check (whether ->length is big enough)
> >and/or
> >> call the function "update"
> >
> >There is a length check in the beginning (first line of the function
> >body).
> >
> Nope.
> The check in the first line checks whether the write is <= the max
> buffer size, but not <= head->length.
> 
> Since head->length is not updated (as per design) it is possible to
> write data without effect using this function.  This is not what I
> expect from an API.
> 
> 
> Example I create a buffer using tpm_buf_append with 12 bytes, so
> head->length == 12 Then I use tpm_buf_store at pos 10 and len 4 --> in
> the buffer are 14 bytes, but tpm_buf_length will only report 12 bytes.
> 
> Which is not what I would expect and your current check dies not prevent this.

Aah. Right. A valid point. I'll add this check to the invariant.

/Jarkko
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/