linux-kernel - Re: [PATCH v7 2/3] tpm: ibmvtpm: Wait for buffer to be set before proceeding

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200313152950.GC142269@linux.intel.com>
Date:   Fri, 13 Mar 2020 17:29:50 +0200
From:   Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
To:     Stefan Berger <stefanb@...ux.vnet.ibm.com>
Cc:     linux-integrity@...r.kernel.org, aik@...abs.ru,
        david@...son.dropbear.id.au, linux-kernel@...r.kernel.org,
        nayna@...ux.vnet.ibm.com, gcwilson@...ux.ibm.com, jgg@...pe.ca,
        Stefan Berger <stefanb@...ux.ibm.com>,
        Nayna Jain <nayna@...ux.ibm.com>
Subject: Re: [PATCH v7 2/3] tpm: ibmvtpm: Wait for buffer to be set before
 proceeding

On Thu, Mar 12, 2020 at 11:53:31AM -0400, Stefan Berger wrote:
> From: Stefan Berger <stefanb@...ux.ibm.com>
> 
> Synchronize with the results from the CRQs before continuing with
> the initialization. This avoids trying to send TPM commands while
> the rtce buffer has not been allocated, yet.
> 
> This patch fixes an existing race condition that may occurr if the
> hypervisor does not quickly respond to the VTPM_GET_RTCE_BUFFER_SIZE
> request sent during initialization and therefore the ibmvtpm->rtce_buf
> has not been allocated at the time the first TPM command is sent.
> 
> Fixes: 132f76294744 ("Add new device driver to support IBM vTPM")
> Signed-off-by: Stefan Berger <stefanb@...ux.ibm.com>
> Acked-by: Nayna Jain <nayna@...ux.ibm.com>
> Tested-by: Nayna Jain <nayna@...ux.ibm.com>
> ---
>  drivers/char/tpm/tpm_ibmvtpm.c | 9 +++++++++
>  drivers/char/tpm/tpm_ibmvtpm.h | 1 +
>  2 files changed, 10 insertions(+)
> 
> diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
> index 78cc52690177..cfe40e7b1ba4 100644
> --- a/drivers/char/tpm/tpm_ibmvtpm.c
> +++ b/drivers/char/tpm/tpm_ibmvtpm.c
> @@ -571,6 +571,7 @@ static irqreturn_t ibmvtpm_interrupt(int irq, void *vtpm_instance)
>  	 */
>  	while ((crq = ibmvtpm_crq_get_next(ibmvtpm)) != NULL) {
>  		ibmvtpm_crq_process(crq, ibmvtpm);
> +		wake_up_interruptible(&ibmvtpm->crq_queue.wq);
>  		crq->valid = 0;
>  		smp_wmb();
>  	}
> @@ -618,6 +619,7 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
>  	}
>  
>  	crq_q->num_entry = CRQ_RES_BUF_SIZE / sizeof(*crq_q->crq_addr);
> +	init_waitqueue_head(&crq_q->wq);
>  	ibmvtpm->crq_dma_handle = dma_map_single(dev, crq_q->crq_addr,
>  						 CRQ_RES_BUF_SIZE,
>  						 DMA_BIDIRECTIONAL);
> @@ -670,6 +672,13 @@ static int tpm_ibmvtpm_probe(struct vio_dev *vio_dev,
>  	if (rc)
>  		goto init_irq_cleanup;
>  
> +	if (!wait_event_timeout(ibmvtpm->crq_queue.wq,
> +				ibmvtpm->rtce_buf != NULL,
> +				HZ)) {
> +		dev_err(dev, "CRQ response timed out\n");
> +		goto init_irq_cleanup;
> +	}
> +
>  	return tpm_chip_register(chip);
>  init_irq_cleanup:
>  	do {
> diff --git a/drivers/char/tpm/tpm_ibmvtpm.h b/drivers/char/tpm/tpm_ibmvtpm.h
> index 7983f1a33267..b92aa7d3e93e 100644
> --- a/drivers/char/tpm/tpm_ibmvtpm.h
> +++ b/drivers/char/tpm/tpm_ibmvtpm.h
> @@ -26,6 +26,7 @@ struct ibmvtpm_crq_queue {
>  	struct ibmvtpm_crq *crq_addr;
>  	u32 index;
>  	u32 num_entry;
> +	wait_queue_head_t wq;
>  };
>  
>  struct ibmvtpm_dev {
> -- 
> 2.23.0
> 

Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>

/Jarkko