linux-kernel - Re: [tpmdd-devel] [PATCH RFC v4 1/5] tpm: validate TPM 2.0 commands

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 22 Jan 2017 21:02:17 -0500
From:   Stefan Berger <stefanb@...ux.vnet.ibm.com>
To:     Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
        tpmdd-devel@...ts.sourceforge.net
Cc:     open list <linux-kernel@...r.kernel.org>,
        linux-security-module@...r.kernel.org
Subject: Re: [tpmdd-devel] [PATCH RFC v4 1/5] tpm: validate TPM 2.0 commands

On 01/22/2017 06:44 PM, Jarkko Sakkinen wrote:
> @@ -1025,8 +1029,60 @@ int tpm2_auto_startup(struct tpm_chip *chip)
>   		}
>   	}
>
> +	rc = tpm2_get_tpm_pt(chip, TPM_PT_TOTAL_COMMANDS, &nr_commands, NULL);
> +	if (rc)
> +		goto out;
> +
> +	/* sanity check */
> +	if (nr_commands > INT_MAX) {
> +		rc = -E2BIG;
> +		goto out;
> +	}
> +
> +	chip->cc_attrs_tbl = devm_kzalloc(&chip->dev, 4 * nr_commands,
> +					  GFP_KERNEL);
> +
> +	rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY);
> +	if (rc)
> +		goto out;
> +
> +	tpm_buf_append_u32(&buf, TPM2_CAP_COMMANDS);
> +	tpm_buf_append_u32(&buf, TPM2_CC_FIRST);
> +	tpm_buf_append_u32(&buf, nr_commands);
> +
> +	rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, 0, 0, NULL);

You should probably pass the min_rsp_body_size as 5 + 4 + nr_commands * 4

> +	if (rc < 0) {
> +		tpm_buf_destroy(&buf);
> +		goto out;
> +	}
> +
> +	if (nr_commands !=
> +	    be32_to_cpup((__be32 *)&buf.data[TPM_HEADER_SIZE + 5])) {
> +		tpm_buf_destroy(&buf);
> +		goto out;
> +	}
> +
> +	chip->nr_commands = nr_commands;
> +
> +	attrs = (u32 *)&buf.data[TPM_HEADER_SIZE + 9];
> +	for (i = 0; i < nr_commands; i++, attrs++)
> +		chip->cc_attrs_tbl[i] = be32_to_cpup(attrs);
> +
> +	tpm_buf_destroy(&buf);
> +
>   out:
>   	if (rc > 0)
>   		rc = -ENODEV;
>   	return rc;
>   }
> +
> +int tpm2_find_cc(struct tpm_chip *chip, u32 cc)
> +{
> +	int i;
> +
> +	for (i = 0; i < chip->nr_commands; i++)
> +		if (cc == (chip->cc_attrs_tbl[i] & GENMASK(15, 0)))
> +			return i;
> +
> +	return -1;
> +}