From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753880AbdARNxi (ORCPT ); Wed, 18 Jan 2017 08:53:38 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:42042 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1752586AbdARNxf (ORCPT ); Wed, 18 Jan 2017 08:53:35 -0500 Subject: Re: [PATCH v6] tpm: Check size of response before accessing data To: Jarkko Sakkinen References: <1484602871-20145-1-git-send-email-stefanb@linux.vnet.ibm.com> <20170117144905.4haeudj3v5ycohr3@intel.com> <20170118133646.uvbkt7d4blv2pdbn@intel.com> Cc: tpmdd-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org From: Stefan Berger Date: Wed, 18 Jan 2017 08:53:19 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <20170118133646.uvbkt7d4blv2pdbn@intel.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 7bit X-TM-AS-GCONF: 00 X-Content-Scanned: Fidelis XPS MAILER x-cbid: 17011813-0016-0000-0000-000005E6F026 X-IBM-SpamModules-Scores: X-IBM-SpamModules-Versions: BY=3.00006456; HX=3.00000240; KW=3.00000007; PH=3.00000004; SC=3.00000199; SDB=6.00809340; UDB=6.00394265; IPR=6.00586697; BA=6.00005071; NDR=6.00000001; ZLA=6.00000005; ZF=6.00000009; ZB=6.00000000; ZP=6.00000000; ZH=6.00000000; ZU=6.00000002; MB=3.00013964; XFM=3.00000011; UTC=2017-01-18 13:53:26 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17011813-0017-0000-0000-00003697F4FC Message-Id: <33bb28b4-6dd5-8455-de44-12b2980006e1@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-01-18_07:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=0 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1612050000 definitions=main-1701180188 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 01/18/2017 08:36 AM, Jarkko Sakkinen wrote: > On Tue, Jan 17, 2017 at 05:27:47PM -0500, Stefan Berger wrote: >> On 01/17/2017 09:49 AM, Jarkko Sakkinen wrote: >>> On Mon, Jan 16, 2017 at 04:41:11PM -0500, Stefan Berger wrote: >>> >>>> + * @min_rx_length: minimum expected length of response >>> Please, rename as min_rsp_body_len and change the description >>> accordingly. >>> >>>> * @flags: tpm transmit flags - bitmap >>>> * @desc: command description used in the error message >>>> * >>>> @@ -434,25 +435,34 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz, >>>> * A positive number for a TPM error. >>>> */ >>>> ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd, >>>> - int len, unsigned int flags, const char *desc) >>>> + size_t cmd_length, size_t min_rx_length, >>>> + unsigned int flags, const char *desc) >>>> { >>>> const struct tpm_output_header *header; >>>> int err; >>>> + ssize_t len; >>>> - len = tpm_transmit(chip, (const u8 *)cmd, len, flags); >>>> + len = tpm_transmit(chip, (const u8 *)cmd, cmd_length, flags); >>>> if (len < 0) >>>> return len; >>>> else if (len < TPM_HEADER_SIZE) >>>> return -EFAULT; >>>> header = cmd; >>>> + if (len < be32_to_cpu(header->length)) >>>> + return -EFAULT; >>>> err = be32_to_cpu(header->return_code); >>>> if (err != 0 && desc) >>>> dev_err(&chip->dev, "A TPM error (%d) occurred %s\n", err, >>>> desc); >>>> + if (err) >>>> + return err; >>>> - return err; >>>> + if (be32_to_cpu(header->length) < min_rx_length) >>>> + return -EFAULT; >>>> + >>>> + return 0; >>>> } >>>> #define TPM_DIGEST_SIZE 20 >>>> @@ -468,7 +478,7 @@ static const struct tpm_input_header tpm_getcap_header = { >>>> }; >>>> ssize_t tpm_getcap(struct tpm_chip *chip, u32 subcap_id, cap_t *cap, >>>> - const char *desc) >>>> + const char *desc, size_t min_cap_length) >>> tpm_getcap update should be its own commit. >> tpm_getcap needs to pass something as min_rsp_body_length to >> tpm_transmit_cmd. What would it pass? > I do not understand the problem. You are already > > TPM_HEADER_SIZE + min_cap_length When we make this two patches (commits), what would tpm_getcap pass to tpm_transmit_cmd in the place of the min_rsp_body_length parameter? I don't think it makes sense to split up this patch.