| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20251127135445.2141241-4-jarkko@kernel.org>
Date: Thu, 27 Nov 2025 15:54:35 +0200
From: Jarkko Sakkinen <jarkko@...nel.org>
To: linux-integrity@...r.kernel.org
Cc: ross.philipson@...cle.com,
Jonathan McDowell <noodles@...th.li>,
Stefano Garzarella <sgarzare@...hat.com>,
Jarkko Sakkinen <jarkko@...nel.org>,
Peter Huewe <peterhuewe@....de>,
Jason Gunthorpe <jgg@...pe.ca>,
James Bottomley <James.Bottomley@...senPartnership.com>,
Mimi Zohar <zohar@...ux.ibm.com>,
David Howells <dhowells@...hat.com>,
Paul Moore <paul@...l-moore.com>,
James Morris <jmorris@...ei.org>,
"Serge E. Hallyn" <serge@...lyn.com>,
linux-kernel@...r.kernel.org,
keyrings@...r.kernel.org,
linux-security-module@...r.kernel.org
Subject: [PATCH v7 03/11] KEYS: trusted: remove redundant instance of tpm2_hash_map
Trusted keys duplicates tpm2_hash_map from TPM driver internals. Implement
and export `tpm2_find_hash_alg()` in order to address this glitch, and
replace redundant code block with a call this new function.
Signed-off-by: Jarkko Sakkinen <jarkko@...nel.org>
---
v7:
- A new patch.
---
drivers/char/tpm/tpm2-cmd.c | 19 +++++++++++++++--
include/linux/tpm.h | 7 ++-----
security/keys/trusted-keys/trusted_tpm2.c | 25 +++++------------------
3 files changed, 24 insertions(+), 27 deletions(-)
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 97501c567c34..1393bfbeca64 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -18,7 +18,10 @@ static bool disable_pcr_integrity;
module_param(disable_pcr_integrity, bool, 0444);
MODULE_PARM_DESC(disable_pcr_integrity, "Disable integrity protection of TPM2_PCR_Extend");
-static struct tpm2_hash tpm2_hash_map[] = {
+static struct {
+ unsigned int crypto_id;
+ unsigned int alg_id;
+} tpm2_hash_map[] = {
{HASH_ALGO_SHA1, TPM_ALG_SHA1},
{HASH_ALGO_SHA256, TPM_ALG_SHA256},
{HASH_ALGO_SHA384, TPM_ALG_SHA384},
@@ -26,6 +29,18 @@ static struct tpm2_hash tpm2_hash_map[] = {
{HASH_ALGO_SM3_256, TPM_ALG_SM3_256},
};
+int tpm2_find_hash_alg(unsigned int crypto_id)
+{
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++)
+ if (crypto_id == tpm2_hash_map[i].crypto_id)
+ return tpm2_hash_map[i].alg_id;
+
+ return -EINVAL;
+}
+EXPORT_SYMBOL_GPL(tpm2_find_hash_alg);
+
int tpm2_get_timeouts(struct tpm_chip *chip)
{
chip->timeout_a = msecs_to_jiffies(TPM2_TIMEOUT_A);
@@ -490,7 +505,7 @@ static int tpm2_init_bank_info(struct tpm_chip *chip, u32 bank_index)
for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) {
enum hash_algo crypto_algo = tpm2_hash_map[i].crypto_id;
- if (bank->alg_id != tpm2_hash_map[i].tpm_id)
+ if (bank->alg_id != tpm2_hash_map[i].alg_id)
continue;
bank->digest_size = hash_digest_size[crypto_algo];
diff --git a/include/linux/tpm.h b/include/linux/tpm.h
index 0e9e043f728c..e5fc7b73de2d 100644
--- a/include/linux/tpm.h
+++ b/include/linux/tpm.h
@@ -410,11 +410,6 @@ enum tpm2_session_attributes {
TPM2_SA_AUDIT = BIT(7),
};
-struct tpm2_hash {
- unsigned int crypto_id;
- unsigned int tpm_id;
-};
-
int tpm_buf_init(struct tpm_buf *buf, u16 tag, u32 ordinal);
void tpm_buf_reset(struct tpm_buf *buf, u16 tag, u32 ordinal);
int tpm_buf_init_sized(struct tpm_buf *buf);
@@ -465,6 +460,7 @@ static inline ssize_t tpm_ret_to_err(ssize_t ret)
#if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE)
+unsigned int tpm2_alg_to_crypto_id(unsigned int alg_id);
extern int tpm_is_tpm2(struct tpm_chip *chip);
extern __must_check int tpm_try_get_ops(struct tpm_chip *chip);
extern void tpm_put_ops(struct tpm_chip *chip);
@@ -477,6 +473,7 @@ extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx,
extern int tpm_get_random(struct tpm_chip *chip, u8 *data, size_t max);
extern struct tpm_chip *tpm_default_chip(void);
void tpm2_flush_context(struct tpm_chip *chip, u32 handle);
+int tpm2_find_hash_alg(unsigned int crypto_id);
static inline void tpm_buf_append_empty_auth(struct tpm_buf *buf, u32 handle)
{
diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c
index 024be262702f..3205732fb4b7 100644
--- a/security/keys/trusted-keys/trusted_tpm2.c
+++ b/security/keys/trusted-keys/trusted_tpm2.c
@@ -18,14 +18,6 @@
#include "tpm2key.asn1.h"
-static struct tpm2_hash tpm2_hash_map[] = {
- {HASH_ALGO_SHA1, TPM_ALG_SHA1},
- {HASH_ALGO_SHA256, TPM_ALG_SHA256},
- {HASH_ALGO_SHA384, TPM_ALG_SHA384},
- {HASH_ALGO_SHA512, TPM_ALG_SHA512},
- {HASH_ALGO_SM3_256, TPM_ALG_SM3_256},
-};
-
static u32 tpm2key_oid[] = { 2, 23, 133, 10, 1, 5 };
static int tpm2_key_encode(struct trusted_key_payload *payload,
@@ -244,24 +236,17 @@ int tpm2_seal_trusted(struct tpm_chip *chip,
off_t offset = TPM_HEADER_SIZE;
struct tpm_buf buf, sized;
int blob_len = 0;
- u32 hash;
+ int hash;
u32 flags;
- int i;
int rc;
- for (i = 0; i < ARRAY_SIZE(tpm2_hash_map); i++) {
- if (options->hash == tpm2_hash_map[i].crypto_id) {
- hash = tpm2_hash_map[i].tpm_id;
- break;
- }
- }
-
- if (i == ARRAY_SIZE(tpm2_hash_map))
- return -EINVAL;
-
if (!options->keyhandle)
return -EINVAL;
+ hash = tpm2_find_hash_alg(options->hash);
+ if (hash)
+ return hash;
+
rc = tpm_try_get_ops(chip);
if (rc)
return rc;
--
2.52.0
Powered by blists - more mailing lists