From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932951AbdA0P1r (ORCPT ); Fri, 27 Jan 2017 10:27:47 -0500 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:52503 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932199AbdA0P1C (ORCPT ); Fri, 27 Jan 2017 10:27:02 -0500 From: Nayna Jain To: tpmdd-devel@lists.sourceforge.net Cc: peterhuewe@gmx.de, tpmdd@selhorst.net, jarkko.sakkinen@linux.intel.com, jgunthorpe@obsidianresearch.com, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Nayna Jain Subject: [PATCH] tpm: add buffer access validation in tpm2_get_pcr_allocation() Date: Fri, 27 Jan 2017 10:25:49 -0500 X-Mailer: git-send-email 2.5.0 X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 17012715-0016-0000-0000-00000213A0F9 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17012715-0017-0000-0000-00000651BD82 Message-Id: <1485530749-22948-1-git-send-email-nayna@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-01-27_10:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=1 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1612050000 definitions=main-1701270152 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch add validation in tpm2_get_pcr_allocation to avoid access beyond response buffer length. Suggested-by: Stefan Berger Signed-off-by: Nayna Jain --- drivers/char/tpm/tpm2-cmd.c | 28 +++++++++++++++++++++++----- 1 file changed, 23 insertions(+), 5 deletions(-) diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index 4aad84c..02c1ea7 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -1008,9 +1008,13 @@ static ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip) struct tpm2_pcr_selection pcr_selection; struct tpm_buf buf; void *marker; - unsigned int count = 0; + void *end; + void *pcr_select_offset; + unsigned int count; + u32 sizeof_pcr_selection; + u32 resp_len; int rc; - int i; + int i = 0; rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_CAPABILITY); if (rc) @@ -1034,15 +1038,29 @@ static ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip) } marker = &buf.data[TPM_HEADER_SIZE + 9]; + + resp_len = be32_to_cpup((__be32 *)&buf.data[2]); + end = &buf.data[resp_len]; + for (i = 0; i < count; i++) { + pcr_select_offset = marker + + offsetof(struct tpm2_pcr_selection, size_of_select); + if (pcr_select_offset >= end) { + rc = -EFAULT; + break; + } + memcpy(&pcr_selection, marker, sizeof(pcr_selection)); chip->active_banks[i] = be16_to_cpu(pcr_selection.hash_alg); - marker = marker + sizeof(struct tpm2_pcr_selection); + sizeof_pcr_selection = sizeof(pcr_selection.hash_alg) + + sizeof(pcr_selection.size_of_select) + + sizeof(u8) * pcr_selection.size_of_select; + marker = marker + sizeof_pcr_selection; } out: - if (count < ARRAY_SIZE(chip->active_banks)) - chip->active_banks[count] = TPM2_ALG_ERROR; + if (i < ARRAY_SIZE(chip->active_banks)) + chip->active_banks[i] = TPM2_ALG_ERROR; tpm_buf_destroy(&buf); -- 2.5.0