lkml.org 
[lkml]   [2019]   [Feb]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v11 00/16] Remove nested TPM operations
On Fri, Feb 08, 2019 at 03:17:54PM +0200, Jarkko Sakkinen wrote:
> On Fri, Feb 08, 2019 at 08:10:32AM -0500, Stefan Berger wrote:
> > On 2/8/19 8:02 AM, Jarkko Sakkinen wrote:
> > > On Fri, Feb 08, 2019 at 07:05:26AM -0500, Stefan Berger wrote:
> > > > See my comment on [PATCH v11 08/16]. It needs to be added in that patch
> > > > since otherwise rc holds a non-zero value on function exit, which is wrong
> > > > at that point.
> > > The snippet in question:
> > >
> > > rc = chip->ops->send(chip, buf, count);
> > > if (rc < 0) {
> > > if (rc != -EPIPE)
> > > dev_err(&chip->dev,
> > > "%s: tpm_send: error %d\n", __func__, rc);
> > > return rc;
> > > }
> > >
> > > if (chip->flags & TPM_CHIP_FLAG_IRQ)
> > > goto out_recv;
> > >
> > > 'send()' ought to return zero on success case.
> > >
> > > This is how the snippet was before applying any patches scheduled for
> > > v5.1:
> > >
> > > rc = chip->ops->send(chip, buf, count);
> > > if (rc < 0) {
> > > if (rc != -EPIPE)
> > > dev_err(&chip->dev,
> > > "%s: tpm_send: error %d\n", __func__, rc);
> > > return rc;
> > > }
> > >
> > > if (chip->flags & TPM_CHIP_FLAG_IRQ)
> > > goto out_recv;
> > >
> > > Does not compute.
> >
> > tpm_tis_send_main returns 'len' and that's what we have here.
>
> Before doing any kind of code change, we should at least know what
> has caused this that it has worked before.
>
> And also which commit caused the regression to happen, because it
> looks like a bug in tpm_tis_core, not in the main TPM driver. It
> would need the fixes tag and cc to stable.

Found the root cause.

len = chip->ops->recv(chip, buf, bufsiz);
if (len < 0) {
rc = len;
dev_err(&chip->dev,
"tpm_transmit: tpm_recv: error %d\n", rc);
goto out;
} else if (len < TPM_HEADER_SIZE) {
rc = -EFAULT;
goto out;
}

if (len != be32_to_cpu(header->length)) {
rc = -EFAULT;
goto out;
}

rc = tpm2_commit_space(chip, space, ordinal, buf, &len);
if (rc)
dev_err(&chip->dev, "tpm2_commit_space: error %d\n", rc);

That unconditional call to commit space masked the bugs in the device
drivers. I'll provide fixes shortly.

/Jarkko

\
 
 \ /
  Last update: 2019-02-08 14:34    [W:0.131 / U:0.820 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site