Skip to contentSkip to conversation

tpm_tis: Check return values from get_burstcount.

PATCH Superseded Josh Zimmerman 2 participants 2 messages Oct 26, 2016 – Oct 27, 2016 1 message not in the archive TPM device driver

v3 of 5 Superseded Latest is v5 →

lore
Share & tools
lore

Josh Zimmerman

author
#0 lore raw

PATCH v3 1/1 tpm_tis: Check return values from get_burstcount.

If the TPM we're connecting to uses a static burst count, it will report a burst count of zero throughout the response read. However, get_burstcount assumes that a response of zero indicates that the TPM is not ready to receive more data. In this case, it returns a negative error code, which is passed on to tpm_tis_{write,read}_bytes as a u16, causing them to read/write far too many bytes.

This patch checks for negative return codes and bails out from recv_data and tpm_tis_send_data.

Fixes 1107d065fdf1
Signed-off-by Josh Zimmerman <[email protected]>

---
Changelog v3:
- Add signed-off-by.
Changelog v2:
- Fix typo (rc->burstcnt)

---
 drivers/char/tpm/tpm_tis_core.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)
drivers/char/tpm/tpm_tis_core.c +13 -0
index e3bf31b..aed92b3 100644
@@ -186,6 +186,12 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
 				 chip->timeout_c,
 				 &priv->read_queue, true) == 0) {
 		burstcnt = min_t(int, get_burstcount(chip), count - size);
+		if (burstcnt < 0) {
+			dev_err(&chip->dev,
+				"Unable to read burstcount in %s:%d (%s)\n",
+				__FILE__, __LINE__, __func__);
+			return burstcnt;
+		}
 
 		rc = tpm_tis_read_bytes(priv, TPM_DATA_FIFO(priv->locality),
 					burstcnt, buf + size);

@@ -272,6 +278,13 @@ static int tpm_tis_send_data(struct tpm_chip *chip, u8 *buf, size_t len)
 
 	while (count < len - 1) {
 		burstcnt = min_t(int, get_burstcount(chip), len - count - 1);
+		if (burstcnt < 0) {
+			dev_err(&chip->dev,
+				"Unable to read burstcount in %s:%d (%s)\n",
+				__FILE__, __LINE__, __func__);
+			rc = burstcnt;
+			goto out_err;
+		}
 		rc = tpm_tis_write_bytes(priv, TPM_DATA_FIFO(priv->locality),
 					 burstcnt, buf + count);
 		if (rc < 0)
Signature · 9 lines
2.8.0.rc3.226.g39d4020


------------------------------------------------------------------------------
The Command Line: Reinvented for Modern Developers
Did the resurgence of CLI tooling catch you by surprise?
Reconnect with the command line and become more productive. 
Learn the new .NET and ASP.NET CLI. Get your free copy!
http://sdm.link/telerik

A message that is not in the archive (sent off-list or not yet received): [email protected]

#2 lore raw
Quoted 11 lines · Josh Zimmerman

If the TPM we're connecting to uses a static burst count, it will report a burst count of zero throughout the response read. However, get_burstcount assumes that a response of zero indicates that the TPM is not ready to receive more data. In this case, it returns a negative error code, which is passed on to tpm_tis_{write,read}_bytes as a u16, causing them to read/write far too many bytes.

This patch checks for negative return codes and bails out from recv_data and tpm_tis_send_data.

Fixes 1107d065fdf1

Fixes line is missing the short summary.

/Jarkko

Quoted 17 lines
Signed-off-by Josh Zimmerman <[email protected]>

---
Changelog v3:
- Add signed-off-by.
Changelog v2:
- Fix typo (rc->burstcnt)

---
 drivers/char/tpm/tpm_tis_core.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)
drivers/char/tpm/tpm_tis_core.c +0 -0
index e3bf31b..aed92b3 100644

drivers/char/tpm/tpm_tis_core.c static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count) · line 194

Quoted 9 lines
drivers/char/tpm/tpm_tis_core.c +6 -0
@@ -186,6 +186,12 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count)
 				 chip->timeout_c,
 				 &priv->read_queue, true) == 0) {
 		burstcnt = min_t(int, get_burstcount(chip), count - size);
+		if (burstcnt < 0) {
+			dev_err(&chip->dev,
+				"Unable to read burstcount in %s:%d (%s)\n",
+				__FILE__, __LINE__, __func__);
+			return burstcnt;
+		}

I gave this even more thought. This should be just

dev_err(&chip->dev, "Unable to read burstcount\n");

Use ftrace if you want to know the call site.

/Jarkko

Quoted 20 lines
drivers/char/tpm/tpm_tis_core.c +7 -0
 		rc = tpm_tis_read_bytes(priv, TPM_DATA_FIFO(priv->locality),
 					burstcnt, buf + size);

@@ -272,6 +278,13 @@ static int tpm_tis_send_data(struct tpm_chip *chip, u8 *buf, size_t len)
 
 	while (count < len - 1) {
 		burstcnt = min_t(int, get_burstcount(chip), len - count - 1);
+		if (burstcnt < 0) {
+			dev_err(&chip->dev,
+				"Unable to read burstcount in %s:%d (%s)\n",
+				__FILE__, __LINE__, __func__);
+			rc = burstcnt;
+			goto out_err;
+		}
 		rc = tpm_tis_write_bytes(priv, TPM_DATA_FIFO(priv->locality),
 					 burstcnt, buf + count);
 		if (rc < 0)
Signature · 1 line
2.8.0.rc3.226.g39d4020

------------------------------------------------------------------------------
The Command Line: Reinvented for Modern Developers Did the resurgence of CLI tooling catch you by surprise? Reconnect with the command line and become more productive. Learn the new .NET and ASP.NET CLI. Get your free copy!
http://sdm.link/telerik