lkml.org 
[lkml]   [2018]   [Dec]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v6 6/7] tpm: ensure that the output of PCR read contains the correct digest size
    Date
    This patch protects against data corruption that could happen in the bus,
    by checking that the digest size returned by the TPM during a PCR read
    matches the size of the algorithm passed to tpm2_pcr_read().

    This check is performed after information about the PCR banks has been
    retrieved.

    Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
    Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
    ---
    drivers/char/tpm/tpm2-cmd.c | 16 +++++++++++++++-
    1 file changed, 15 insertions(+), 1 deletion(-)

    diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
    index a804f0b7126a..d6d29480348c 100644
    --- a/drivers/char/tpm/tpm2-cmd.c
    +++ b/drivers/char/tpm/tpm2-cmd.c
    @@ -179,15 +179,28 @@ struct tpm2_pcr_read_out {
    int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx,
    struct tpm_digest *digest, u16 *digest_size_ptr)
    {
    + int i;
    int rc;
    struct tpm_buf buf;
    struct tpm2_pcr_read_out *out;
    u8 pcr_select[TPM2_PCR_SELECT_MIN] = {0};
    u16 digest_size;
    + u16 expected_digest_size = 0;

    if (pcr_idx >= TPM2_PLATFORM_PCR)
    return -EINVAL;

    + if (!digest_size_ptr) {
    + for (i = 0; i < chip->nr_allocated_banks &&
    + chip->allocated_banks[i].alg_id != digest->alg_id; i++)
    + ;
    +
    + if (i == chip->nr_allocated_banks)
    + return -EINVAL;
    +
    + expected_digest_size = chip->allocated_banks[i].digest_size;
    + }
    +
    rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_PCR_READ);
    if (rc)
    return rc;
    @@ -207,7 +220,8 @@ int tpm2_pcr_read(struct tpm_chip *chip, u32 pcr_idx,

    out = (struct tpm2_pcr_read_out *)&buf.data[TPM_HEADER_SIZE];
    digest_size = be16_to_cpu(out->digest_size);
    - if (digest_size > sizeof(digest->digest)) {
    + if (digest_size > sizeof(digest->digest) ||
    + (!digest_size_ptr && digest_size != expected_digest_size)) {
    rc = -EINVAL;
    goto out;
    }
    --
    2.17.1
    \
     
     \ /
      Last update: 2018-12-04 09:28    [W:4.154 / U:0.216 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site