From patchwork Wed Aug 24 00:57:22 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarkko Sakkinen X-Patchwork-Id: 9296663 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 05AAC607D0 for ; Wed, 24 Aug 2016 00:58:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F318B28485 for ; Wed, 24 Aug 2016 00:58:00 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E77CA28D38; Wed, 24 Aug 2016 00:58:00 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4D66A28485 for ; Wed, 24 Aug 2016 00:58:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753267AbcHXA5o (ORCPT ); Tue, 23 Aug 2016 20:57:44 -0400 Received: from mga07.intel.com ([134.134.136.100]:14196 "EHLO mga07.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755437AbcHXA5l (ORCPT ); Tue, 23 Aug 2016 20:57:41 -0400 Received: from fmsmga003.fm.intel.com ([10.253.24.29]) by orsmga105.jf.intel.com with ESMTP; 23 Aug 2016 17:57:22 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.28,568,1464678000"; d="scan'208";a="752683894" Received: from lcagba-mobl1.amr.corp.intel.com (HELO localhost) ([10.254.85.143]) by FMSMGA003.fm.intel.com with ESMTP; 23 Aug 2016 17:57:21 -0700 From: Jarkko Sakkinen To: Peter Huewe Cc: linux-security-module@vger.kernel.org, Jarkko Sakkinen , stable@vger.kernel.org, Marcel Selhorst , Jason Gunthorpe , tpmdd-devel@lists.sourceforge.net (moderated list:TPM DEVICE DRIVER), linux-kernel@vger.kernel.org (open list) Subject: [PATCH] tpm: fix a race condition tpm2_unseal_trusted() Date: Tue, 23 Aug 2016 20:57:22 -0400 Message-Id: <1472000243-7088-1-git-send-email-jarkko.sakkinen@linux.intel.com> X-Mailer: git-send-email 2.7.4 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Unseal and load operations should be done as an atomic operation. This commit introduces unlocked tpm_transmit() so that tpm2_unseal_trusted() can do the locking by itself. v2: Introduced an unlocked unseal operation instead of changing locking strategy in order to make less intrusive bug fix and thus more backportable. v3: Have also separate __tpm_transmit() that takes 'flags' in order to better localize the bug fix and make it easier to backport. v4: Cleaned up the control flow in tpm2_unseal_trusted. Added the missing 'Fixes' line. Fixes: 0fe5480303a1 ("keys, trusted: seal/unseal with TPM 2.0 chips") CC: stable@vger.kernel.org Signed-off-by: Jarkko Sakkinen --- drivers/char/tpm/tpm-interface.c | 16 +++++++++------- drivers/char/tpm/tpm.h | 25 +++++++++++++++++++++---- drivers/char/tpm/tpm2-cmd.c | 12 ++++++++---- 3 files changed, 38 insertions(+), 15 deletions(-) diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c index 43ef0ef..80e702a 100644 --- a/drivers/char/tpm/tpm-interface.c +++ b/drivers/char/tpm/tpm-interface.c @@ -330,8 +330,8 @@ EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration); /* * Internal kernel interface to transmit TPM commands */ -ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf, - size_t bufsiz) +ssize_t __tpm_transmit(struct tpm_chip *chip, const char *buf, + size_t bufsiz, unsigned int flags) { ssize_t rc; u32 count, ordinal; @@ -350,7 +350,8 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf, return -E2BIG; } - mutex_lock(&chip->tpm_mutex); + if (flags & TPM_TRANSMIT_LOCK) + mutex_lock(&chip->tpm_mutex); rc = chip->ops->send(chip, (u8 *) buf, count); if (rc < 0) { @@ -393,20 +394,21 @@ out_recv: dev_err(&chip->dev, "tpm_transmit: tpm_recv: error %zd\n", rc); out: - mutex_unlock(&chip->tpm_mutex); + if (flags & TPM_TRANSMIT_LOCK) + mutex_unlock(&chip->tpm_mutex); return rc; } #define TPM_DIGEST_SIZE 20 #define TPM_RET_CODE_IDX 6 -ssize_t tpm_transmit_cmd(struct tpm_chip *chip, void *cmd, - int len, const char *desc) +ssize_t __tpm_transmit_cmd(struct tpm_chip *chip, void *cmd, + int len, const char *desc, unsigned int flags) { struct tpm_output_header *header; int err; - len = tpm_transmit(chip, (u8 *) cmd, len); + len = __tpm_transmit(chip, cmd, len, flags); if (len < 0) return len; else if (len < TPM_HEADER_SIZE) diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h index 6e002c4..0a4abf0 100644 --- a/drivers/char/tpm/tpm.h +++ b/drivers/char/tpm/tpm.h @@ -476,12 +476,29 @@ extern dev_t tpm_devt; extern const struct file_operations tpm_fops; extern struct idr dev_nums_idr; +enum tpm_transmit_flags { + TPM_TRANSMIT_LOCK, +}; + +ssize_t __tpm_transmit(struct tpm_chip *chip, const char *buf, + size_t bufsiz, unsigned int flags); +ssize_t __tpm_transmit_cmd(struct tpm_chip *chip, void *cmd, int len, + const char *desc, unsigned int flags); + +static inline ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf, + size_t bufsiz) +{ + return __tpm_transmit(chip, buf, bufsiz, TPM_TRANSMIT_LOCK); +} + +static inline ssize_t tpm_transmit_cmd(struct tpm_chip *chip, void *cmd, + int len, const char *desc) +{ + return __tpm_transmit_cmd(chip, cmd, len, desc, TPM_TRANSMIT_LOCK); +} + ssize_t tpm_getcap(struct tpm_chip *chip, __be32 subcap_id, cap_t *cap, const char *desc); -ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf, - size_t bufsiz); -ssize_t tpm_transmit_cmd(struct tpm_chip *chip, void *cmd, int len, - const char *desc); int tpm_get_timeouts(struct tpm_chip *chip); int tpm1_auto_startup(struct tpm_chip *chip); int tpm_do_selftest(struct tpm_chip *chip); diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index 499f405..a2a0314 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -576,7 +576,7 @@ static int tpm2_load(struct tpm_chip *chip, goto out; } - rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "loading blob"); + rc = __tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "loading blob", 0); if (!rc) *blob_handle = be32_to_cpup( (__be32 *) &buf.data[TPM_HEADER_SIZE]); @@ -604,7 +604,8 @@ static void tpm2_flush_context(struct tpm_chip *chip, u32 handle) tpm_buf_append_u32(&buf, handle); - rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "flushing context"); + rc = __tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "flushing context", + 0); if (rc) dev_warn(&chip->dev, "0x%08x was not flushed, rc=%d\n", handle, rc); @@ -635,7 +636,7 @@ static int tpm2_unseal(struct tpm_chip *chip, options->blobauth /* hmac */, TPM_DIGEST_SIZE); - rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "unsealing"); + rc = __tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, "unsealing", 0); if (rc > 0) rc = -EPERM; @@ -668,14 +669,17 @@ int tpm2_unseal_trusted(struct tpm_chip *chip, u32 blob_handle; int rc; + mutex_lock(&chip->tpm_mutex); rc = tpm2_load(chip, payload, options, &blob_handle); if (rc) - return rc; + goto out; rc = tpm2_unseal(chip, payload, options, blob_handle); tpm2_flush_context(chip, blob_handle); +out: + mutex_unlock(&chip->tpm_mutex); return rc; }