From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S965765AbbJVUct (ORCPT <rfc822;w@1wt.eu>);
	Thu, 22 Oct 2015 16:32:49 -0400
Received: from smtp04.smtpout.orange.fr ([80.12.242.126]:31560 "EHLO
	smtp.smtpout.orange.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S965698AbbJVUcs (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Thu, 22 Oct 2015 16:32:48 -0400
X-ME-Helo: localhost.localdomain
X-ME-Auth: Y2hyaXN0b3BoZS5qYWlsbGV0QHdhbmFkb28uZnI=
X-ME-Date: Thu, 22 Oct 2015 22:32:46 +0200
X-ME-IP: 92.140.167.196
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
To: peterhuewe@gmx.de, tpmdd@selhorst.net, jarkko.sakkinen@linux.intel.com
Cc: tpmdd-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org,
        kernel-janitors@vger.kernel.org,
        Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Subject: [PATCH] TPM: Avoid reference to potentially freed memory
Date: Thu, 22 Oct 2015 22:32:41 +0200
Message-Id: <1445545961-5620-1-git-send-email-christophe.jaillet@wanadoo.fr>
X-Mailer: git-send-email 2.1.4
X-Antivirus: avast! (VPS 151022-0, 22/10/2015), Outbound message
X-Antivirus-Status: Clean
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

Reference to the 'np' node is dropped before dereferencing the 'sizep' and
'basep' pointers, which could by then point to junk if the node has been
freed.

Refactor code to call 'of_node_pup' later.

Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
---
 drivers/char/tpm/tpm_of.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/char/tpm/tpm_of.c b/drivers/char/tpm/tpm_of.c
index 1141456..570f30c 100644
--- a/drivers/char/tpm/tpm_of.c
+++ b/drivers/char/tpm/tpm_of.c
@@ -53,17 +53,18 @@ int read_log(struct tpm_bios_log *log)
 		goto cleanup_eio;
 	}
 
-	of_node_put(np);
 	log->bios_event_log = kmalloc(*sizep, GFP_KERNEL);
 	if (!log->bios_event_log) {
 		pr_err("%s: ERROR - Not enough memory for BIOS measurements\n",
 		       __func__);
+		of_node_put(np);
 		return -ENOMEM;
 	}
 
 	log->bios_event_log_end = log->bios_event_log + *sizep;
 
 	memcpy(log->bios_event_log, __va(*basep), *sizep);
+	of_node_put(np);
 
 	return 0;
 
-- 
2.1.4


From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1752398AbbJWHhj (ORCPT <rfc822;w@1wt.eu>);
	Fri, 23 Oct 2015 03:37:39 -0400
Received: from mga03.intel.com ([134.134.136.65]:2690 "EHLO mga03.intel.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1752250AbbJWHhi (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Fri, 23 Oct 2015 03:37:38 -0400
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.20,185,1444719600"; 
   d="scan'208";a="670130582"
Date: Fri, 23 Oct 2015 10:37:33 +0300
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: peterhuewe@gmx.de, tpmdd@selhorst.net, tpmdd-devel@lists.sourceforge.net,
        linux-kernel@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [PATCH] TPM: Avoid reference to potentially freed memory
Message-ID: <20151023073733.GA6941@intel.com>
References: <1445545961-5620-1-git-send-email-christophe.jaillet@wanadoo.fr>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <1445545961-5620-1-git-send-email-christophe.jaillet@wanadoo.fr>
Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo
User-Agent: Mutt/1.5.23 (2014-03-12)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Oct 22, 2015 at 10:32:41PM +0200, Christophe JAILLET wrote:
> Reference to the 'np' node is dropped before dereferencing the 'sizep' and
> 'basep' pointers, which could by then point to junk if the node has been
> freed.
> 
> Refactor code to call 'of_node_pup' later.
> 
> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>

LGTM.

Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

> ---
>  drivers/char/tpm/tpm_of.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/char/tpm/tpm_of.c b/drivers/char/tpm/tpm_of.c
> index 1141456..570f30c 100644
> --- a/drivers/char/tpm/tpm_of.c
> +++ b/drivers/char/tpm/tpm_of.c
> @@ -53,17 +53,18 @@ int read_log(struct tpm_bios_log *log)
>  		goto cleanup_eio;
>  	}
>  
> -	of_node_put(np);
>  	log->bios_event_log = kmalloc(*sizep, GFP_KERNEL);
>  	if (!log->bios_event_log) {
>  		pr_err("%s: ERROR - Not enough memory for BIOS measurements\n",
>  		       __func__);
> +		of_node_put(np);
>  		return -ENOMEM;
>  	}
>  
>  	log->bios_event_log_end = log->bios_event_log + *sizep;
>  
>  	memcpy(log->bios_event_log, __va(*basep), *sizep);
> +	of_node_put(np);
>  
>  	return 0;
>  
> -- 
> 2.1.4
> 

/Jarkko

From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1753495AbbJ0K1r (ORCPT <rfc822;w@1wt.eu>);
	Tue, 27 Oct 2015 06:27:47 -0400
Received: from mga03.intel.com ([134.134.136.65]:25516 "EHLO mga03.intel.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1752313AbbJ0K1q (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Tue, 27 Oct 2015 06:27:46 -0400
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.20,204,1444719600"; 
   d="scan'208";a="804169819"
Date: Tue, 27 Oct 2015 12:27:23 +0200
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: kernel-janitors@vger.kernel.org, tpmdd-devel@lists.sourceforge.net,
        linux-kernel@vger.kernel.org
Subject: Re: [tpmdd-devel] [PATCH] TPM: Avoid reference to potentially freed
 memory
Message-ID: <20151027102723.GA9120@intel.com>
References: <1445545961-5620-1-git-send-email-christophe.jaillet@wanadoo.fr>
 <20151023073733.GA6941@intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20151023073733.GA6941@intel.com>
Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo
User-Agent: Mutt/1.5.23 (2014-03-12)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Oct 23, 2015 at 10:37:33AM +0300, Jarkko Sakkinen wrote:
> On Thu, Oct 22, 2015 at 10:32:41PM +0200, Christophe JAILLET wrote:
> > Reference to the 'np' node is dropped before dereferencing the 'sizep' and
> > 'basep' pointers, which could by then point to junk if the node has been
> > freed.
> > 
> > Refactor code to call 'of_node_pup' later.
> > 
> > Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> 
> LGTM.

Is there anyone able to provide Tested-by for this?

Christophe, were you able to reproduce the crash (insmod/rmmod couple
of times maybe?) and validate that it was gone after fixing the bug?

> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

/Jarkko

From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1755486AbbJ2GMJ (ORCPT <rfc822;w@1wt.eu>);
	Thu, 29 Oct 2015 02:12:09 -0400
Received: from smtp05.smtpout.orange.fr ([80.12.242.127]:42468 "EHLO
	smtp.smtpout.orange.fr" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1751025AbbJ2GMH (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Thu, 29 Oct 2015 02:12:07 -0400
X-ME-Helo: [127.0.0.1]
X-ME-Date: Thu, 29 Oct 2015 07:12:04 +0100
X-ME-IP: 92.140.232.207
Subject: Re: [tpmdd-devel] [PATCH] TPM: Avoid reference to potentially freed
 memory
To: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
References: <1445545961-5620-1-git-send-email-christophe.jaillet@wanadoo.fr>
 <20151023073733.GA6941@intel.com> <20151027102723.GA9120@intel.com>
Cc: kernel-janitors@vger.kernel.org, tpmdd-devel@lists.sourceforge.net,
        linux-kernel@vger.kernel.org
From: Marion & Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Message-ID: <5631B8B1.9020000@wanadoo.fr>
Date: Thu, 29 Oct 2015 07:12:01 +0100
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101
 Thunderbird/38.3.0
MIME-Version: 1.0
In-Reply-To: <20151027102723.GA9120@intel.com>
Content-Type: text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding: 8bit
X-Antivirus: avast! (VPS 151028-1, 28/10/2015), Outbound message
X-Antivirus-Status: Clean
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org



Le 27/10/2015 11:27, Jarkko Sakkinen a écrit :
> On Fri, Oct 23, 2015 at 10:37:33AM +0300, Jarkko Sakkinen wrote:
>> On Thu, Oct 22, 2015 at 10:32:41PM +0200, Christophe JAILLET wrote:
>>> Reference to the 'np' node is dropped before dereferencing the 'sizep' and
>>> 'basep' pointers, which could by then point to junk if the node has been
>>> freed.
>>>
>>> Refactor code to call 'of_node_pup' later.
>>>
>>> Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
>> LGTM.
> Is there anyone able to provide Tested-by for this?
>
> Christophe, were you able to reproduce the crash (insmod/rmmod couple
> of times maybe?) and validate that it was gone after fixing the bug?

Hi,
no, I never triggered the bug.
This is just something noticed while looking at potential issues related 
to incorrect use of 'of_node_pup'.
I only compile tested the patch.

Best regards,
CJ

>
>> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
> /Jarkko
>


From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1756252AbbJ2Kst (ORCPT <rfc822;w@1wt.eu>);
	Thu, 29 Oct 2015 06:48:49 -0400
Received: from mga01.intel.com ([192.55.52.88]:43266 "EHLO mga01.intel.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1750927AbbJ2Kss (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Thu, 29 Oct 2015 06:48:48 -0400
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.20,213,1444719600"; 
   d="scan'208";a="674213410"
Date: Thu, 29 Oct 2015 12:48:44 +0200
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: Marion & Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: kernel-janitors@vger.kernel.org, tpmdd-devel@lists.sourceforge.net,
        linux-kernel@vger.kernel.org
Subject: Re: [tpmdd-devel] [PATCH] TPM: Avoid reference to potentially freed
 memory
Message-ID: <20151029104844.GA10327@intel.com>
References: <1445545961-5620-1-git-send-email-christophe.jaillet@wanadoo.fr>
 <20151023073733.GA6941@intel.com>
 <20151027102723.GA9120@intel.com>
 <5631B8B1.9020000@wanadoo.fr>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <5631B8B1.9020000@wanadoo.fr>
Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo
User-Agent: Mutt/1.5.23 (2014-03-12)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Oct 29, 2015 at 07:12:01AM +0100, Marion & Christophe JAILLET wrote:
> 
> 
> Le 27/10/2015 11:27, Jarkko Sakkinen a écrit :
> >On Fri, Oct 23, 2015 at 10:37:33AM +0300, Jarkko Sakkinen wrote:
> >>On Thu, Oct 22, 2015 at 10:32:41PM +0200, Christophe JAILLET wrote:
> >>>Reference to the 'np' node is dropped before dereferencing the 'sizep' and
> >>>'basep' pointers, which could by then point to junk if the node has been
> >>>freed.
> >>>
> >>>Refactor code to call 'of_node_pup' later.
> >>>
> >>>Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> >>LGTM.
> >Is there anyone able to provide Tested-by for this?
> >
> >Christophe, were you able to reproduce the crash (insmod/rmmod couple
> >of times maybe?) and validate that it was gone after fixing the bug?
> 
> Hi,
> no, I never triggered the bug.
> This is just something noticed while looking at potential issues related to
> incorrect use of 'of_node_pup'.
> I only compile tested the patch.

The fix is so obvious that I see no reason not to include it. Thanks for
the good work.

> Best regards,
> CJ

/Jarkko

From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S1030968AbbJ3LiP (ORCPT <rfc822;w@1wt.eu>);
	Fri, 30 Oct 2015 07:38:15 -0400
Received: from mga14.intel.com ([192.55.52.115]:54270 "EHLO mga14.intel.com"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1030877AbbJ3LiN (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
	Fri, 30 Oct 2015 07:38:13 -0400
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.20,217,1444719600"; 
   d="scan'208";a="838780593"
Date: Fri, 30 Oct 2015 13:38:10 +0200
From: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
To: Marion & Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: kernel-janitors@vger.kernel.org, tpmdd-devel@lists.sourceforge.net,
        linux-kernel@vger.kernel.org
Subject: Re: [tpmdd-devel] [PATCH] TPM: Avoid reference to potentially freed
 memory
Message-ID: <20151030113810.GA31463@intel.com>
References: <1445545961-5620-1-git-send-email-christophe.jaillet@wanadoo.fr>
 <20151023073733.GA6941@intel.com>
 <20151027102723.GA9120@intel.com>
 <5631B8B1.9020000@wanadoo.fr>
 <20151029104844.GA10327@intel.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20151029104844.GA10327@intel.com>
Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo
User-Agent: Mutt/1.5.23 (2014-03-12)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Oct 29, 2015 at 12:48:44PM +0200, Jarkko Sakkinen wrote:
> On Thu, Oct 29, 2015 at 07:12:01AM +0100, Marion & Christophe JAILLET wrote:
> > 
> > 
> > Le 27/10/2015 11:27, Jarkko Sakkinen a écrit :
> > >On Fri, Oct 23, 2015 at 10:37:33AM +0300, Jarkko Sakkinen wrote:
> > >>On Thu, Oct 22, 2015 at 10:32:41PM +0200, Christophe JAILLET wrote:
> > >>>Reference to the 'np' node is dropped before dereferencing the 'sizep' and
> > >>>'basep' pointers, which could by then point to junk if the node has been
> > >>>freed.
> > >>>
> > >>>Refactor code to call 'of_node_pup' later.
> > >>>
> > >>>Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> > >>LGTM.
> > >Is there anyone able to provide Tested-by for this?
> > >
> > >Christophe, were you able to reproduce the crash (insmod/rmmod couple
> > >of times maybe?) and validate that it was gone after fixing the bug?
> > 
> > Hi,
> > no, I never triggered the bug.
> > This is just something noticed while looking at potential issues related to
> > incorrect use of 'of_node_pup'.
> > I only compile tested the patch.
> 
> The fix is so obvious that I see no reason not to include it. Thanks for
> the good work.

I'm getting

$ git am ~/tmp/of-fix.patch 
Applying: TPM: Avoid reference to potentially freed memory
error: patch failed: drivers/char/tpm/tpm_of.c:53
error: drivers/char/tpm/tpm_of.c: patch does not apply
Patch failed at 0001 TPM: Avoid reference to potentially freed memory
The copy of the patch that failed is found in:
   /home/jsakkine/projects/tpm2/git/linux-tpmdd/.git/rebase-apply/patch
   When you have resolved this problem, run "git am --continue".
   If you prefer to skip this patch, run "git am --skip" instead.
   To restore the original branch and stop patching, run "git am
   --abort".

I'm applying this against Linus tree (4.3-rc7).

/Jarkko

