linux-kernel - Re: [PATCH v4 1/2] tpm: implement TPM 2.0 capability to get active PCR banks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <5880C074.9050401@linux.vnet.ibm.com>
Date:   Thu, 19 Jan 2017 19:04:44 +0530
From:   Nayna <nayna@...ux.vnet.ibm.com>
To:     Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
Cc:     tpmdd-devel@...ts.sourceforge.net, peterhuewe@....de,
        tpmdd@...horst.net, jgunthorpe@...idianresearch.com,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4 1/2] tpm: implement TPM 2.0 capability to get active
 PCR banks



On 01/19/2017 04:17 PM, Jarkko Sakkinen wrote:
> On Wed, Jan 18, 2017 at 07:19:06PM +0530, Nayna wrote:
>>
>>
>> On 01/18/2017 07:15 PM, Jarkko Sakkinen wrote:
>>> On Wed, Jan 18, 2017 at 03:44:49AM -0500, Nayna Jain wrote:
>>>> This patch implements the TPM 2.0 capability TPM_CAP_PCRS to
>>>> retrieve the active PCR banks from the TPM. This is needed
>>>> to enable extending all active banks as recommended by TPM 2.0
>>>> TCG Specification.
>>>>
>>>> Signed-off-by: Nayna Jain <nayna@...ux.vnet.ibm.com>
>>>> ---
>>>>    drivers/char/tpm/tpm.h      |  4 ++++
>>>>    drivers/char/tpm/tpm2-cmd.c | 57 +++++++++++++++++++++++++++++++++++++++++++++
>>>>    2 files changed, 61 insertions(+)
>>>>
>>>> diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
>>>> index 1ae9768..dddd573 100644
>>>> --- a/drivers/char/tpm/tpm.h
>>>> +++ b/drivers/char/tpm/tpm.h
>>>> @@ -127,6 +127,7 @@ enum tpm2_permanent_handles {
>>>>    };
>>>>
>>>>    enum tpm2_capabilities {
>>>> +	TPM2_CAP_PCRS		= 5,
>>>>    	TPM2_CAP_TPM_PROPERTIES = 6,
>>>>    };
>>>>
>>>> @@ -187,6 +188,8 @@ struct tpm_chip {
>>>>
>>>>    	const struct attribute_group *groups[3];
>>>>    	unsigned int groups_cnt;
>>>> +
>>>> +	u16 active_banks[7];
>>>>    #ifdef CONFIG_ACPI
>>>>    	acpi_handle acpi_dev_handle;
>>>>    	char ppi_version[TPM_PPI_VERSION_LEN + 1];
>>>> @@ -545,4 +548,5 @@ int tpm2_auto_startup(struct tpm_chip *chip);
>>>>    void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type);
>>>>    unsigned long tpm2_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal);
>>>>    int tpm2_probe(struct tpm_chip *chip);
>>>> +ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip);
>>>>    #endif
>>>> diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
>>>> index 6eda239..75a7546 100644
>>>> --- a/drivers/char/tpm/tpm2-cmd.c
>>>> +++ b/drivers/char/tpm/tpm2-cmd.c
>>>> @@ -998,3 +998,60 @@ int tpm2_auto_startup(struct tpm_chip *chip)
>>>>    		rc = -ENODEV;
>>>>    	return rc;
>>>>    }
>>>> +
>>>> +struct tpm2_pcr_selection {
>>>> +	__be16  hash_alg;
>>>> +	u8  size_of_select;
>>>> +	u8  pcr_select[3];
>>>> +} __packed;
>>>> +
>>>> +/**
>>>> + * tpm2_get_pcr_allocation() - get TPM active PCR banks.
>>>> + *
>>>> + * @chip: TPM chip to use.
>>>> + *
>>>> + * Return: Same as with tpm_transmit_cmd.
>>>> + */
>>>> +ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
>>>> +{
>>>> +	struct tpm2_pcr_selection pcr_selection;
>>>> +	struct tpm_buf buf;
>>>> +	void *marker;
>>>> +	unsigned int count = 0;
>>>
>>> You shouldn't initialize 'count'.
>>
>> It is initialized for reason below:
>>
>>>
>>>> +	int rc;
>>>> +	int i;
>>>> +
>>>> +	rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY);
>>>> +	if (rc)
>>>> +		return rc;
>>>> +
>>>> +	tpm_buf_append_u32(&buf, TPM2_CAP_PCRS);
>>>> +	tpm_buf_append_u32(&buf, 0);
>>>> +	tpm_buf_append_u32(&buf, 1);
>>>> +
>>>> +	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, 0,
>>>> +			      "get tpm pcr allocation");
>>>> +	if (rc < 0)
>>>> +		goto out;
>>
>> if  tpm_transmit_cmd()fails, it jumps to out:
>> where count is used in if(..).
>
> Why the out label is placed there and not after?

Since tpm2_get_pcr_allocation() returns from here as failure,
chip->active_banks doesn't get anytime initialized.

By placing it there, for failure, chip->active_bank[0] is initialized to 0.
Then its later use like in tpm_pcr_extend(), it loops on this array till 
there is a value "0"(considered as invalid) or reaches max size of array.

>
>>
>> Thanks & Regards,
>>     - Nayna
>>
>>>> +
>>>> +	count = be32_to_cpup(
>>>> +		(__be32 *)&buf.data[TPM_HEADER_SIZE + 5]);
>>>> +
>>>> +	if (count > ARRAY_SIZE(chip->active_banks))
>>>> +		return -ENODEV;
>
> Hey, here's a regression (didn't notice it last time). You
> nee to call tpm_buf_destroy().

Oh!! Yes, Thanks !!. I will fix this with:
rc = -ENODEV;
goto out;

Thanks & Regards
    - Nayna

>
>
>>>> +
>>>> +	marker = &buf.data[TPM_HEADER_SIZE + 9];
>>>> +	for (i = 0; i < count; i++) {
>>>> +		memcpy(&pcr_selection, marker, sizeof(pcr_selection));
>>>> +		chip->active_banks[i] = be16_to_cpu(pcr_selection.hash_alg);
>>>> +		marker = marker + sizeof(struct tpm2_pcr_selection);
>>>> +	}
>>>> +
>>>> +out:
>>>> +	if (count < ARRAY_SIZE(chip->active_banks))
>>>> +		chip->active_banks[count] = 0;
>>>> +
>>>> +	tpm_buf_destroy(&buf);
>>>> +
>>>> +	return rc;
>>>> +}
>>>> --
>>>> 2.5.0
>>>
>>> Otherwise,
>>>
>>> Reviewed-by: Jarkko Sakkinen <jarkko.sakkien@...ux.intel.com>
>>>
>>> /Jarkko
>>>
>>
>
> /Jarkko
>