tpm: Actually fail on TPM errors during "get random"
Subsystems (2)
PATCH v3 1/1 tpm: Actually fail on TPM errors during "get random"
A "get random" may fail with a TPM error, but those codes were returned as-is to the caller, which assumed the result was the number of bytes that had been written to the target buffer, which could lead to a kernel heap memory exposure and over-read.
This fixes tpm1_get_random() to mask positive TPM errors into -EIO, as before.
[ 18.092103] tpm tpm0: A TPM error (379) occurred attempting get random [ 18.092106] usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-64' (offset 0, size 379)!
---
v3: fix never-succeed, limit checks to tpm cmd return (James, Jason)
v2: also fix tpm2 implementation (Jason Gunthorpe)
--- drivers/char/tpm/tpm1-cmd.c | 7 +++++-- drivers/char/tpm/tpm2-cmd.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-)
drivers/char/tpm/tpm1-cmd.c +5 -2
@@ -510,7 +510,7 @@ struct tpm1_get_random_out {* * Return: * * number of bytes read -* * -errno or a TPM return code otherwise +* * -errno (positive TPM return codes are masked to -EIO) */ int tpm1_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {
@@ -531,8 +531,11 @@ int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max) rc =tpm_transmit_cmd (chip, &buf,sizeof (out->rng_data_len),"attempting get random" ); -if (rc) +if (rc) { +if (rc >0 ) + rc = -EIO ; goto out; + } out = (struct tpm1_get_random_out *)&buf.data[TPM_HEADER_SIZE ];
drivers/char/tpm/tpm2-cmd.c +5 -2
@@ -301,7 +301,7 @@ struct tpm2_get_random_out {* * Return: * size of the buffer on success, -* -errno otherwise +* -errno otherwise ((positive TPM return codes are masked to -EIO) */ int tpm2_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {
@@ -328,8 +328,11 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) offsetof(struct tpm2_get_random_out , buffer), "attempting get random"); -if (err) +if (err) { +if (err >0 ) + err = -EIO ; goto out; + } out = (struct tpm2_get_random_out *) &buf.data[TPM_HEADER_SIZE ];
Signature · 5 lines
2.17.1 -- Kees Cook
Jason Gunthorpe
reviewerQuoted 55 lines · Kees Cook
A "get random" may fail with a TPM error, but those codes were returned as-is to the caller, which assumed the result was the number of bytes that had been written to the target buffer, which could lead to a kernel heap memory exposure and over-read.
This fixes
tpm1_get_random()to mask positive TPM errors into-EIO, as before.[ 18.092103] tpm tpm0: A TPM error (379) occurred attempting get random [ 18.092106] usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-64' (offset 0, size 379)!Reported-by Phil Baker <[email protected]>Reported-by Craig Robson <[email protected]>Fixes 7aee9c52d7ac ("tpm: tpm1: rewrite tpm1_get_random() using tpm_buf structure")Cc Laura Abbott <[email protected]>Cc Tomas Winkler <[email protected]>Cc Jarkko Sakkinen <[email protected]>Signed-off-by Kees Cook <[email protected]>v3: fix never-succeed, limit checks to tpm cmd return (James, Jason)
v2: also fix tpm2 implementation (Jason Gunthorpe)drivers/char/tpm/tpm1-cmd.c | 7 +++++-- drivers/char/tpm/tpm2-cmd.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-)drivers/char/tpm/tpm1-cmd.c +6
-2+++ b/drivers/char/tpm/tpm1-cmd.c@@ -510,7 +510,7 @@ struct tpm1_get_random_out {* * Return: * * number of bytes read -* * -errno or a TPM return code otherwise +* * -errno (positive TPM return codes are masked to -EIO) */ int tpm1_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {@@ -531,8 +531,11 @@ int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max) rc =tpm_transmit_cmd (chip, &buf,sizeof (out->rng_data_len),"attempting get random" ); -if (rc) +if (rc) { +if (rc >0 ) + rc = -EIO ; goto out; + } out = (struct tpm1_get_random_out *)&buf.data[TPM_HEADER_SIZE ];drivers/char/tpm/tpm2-cmd.c +1
-0+++ b/drivers/char/tpm/tpm2-cmd.c
drivers/char/tpm/tpm2-cmd.c struct tpm2_get_random_out { · line 304
Quoted 5 lines
drivers/char/tpm/tpm2-cmd.c +1
-1@@ -301,7 +301,7 @@ struct tpm2_get_random_out {* * Return: * size of the buffer on success, -* -errno otherwise +* -errno otherwise ((positive TPM return codes are masked to -EIO)
Extra bracket, but otherwise looks fine to me
Jason
Quoted 3 lines · Jason Gunthorpe
Quoted 1 line
+ * -errno otherwise ((positive TPM return codes are masked to
-EIO)Extra bracket, but otherwise looks fine to me
Thanks! (And I guess it's time for lunch so I can take a break and learn how to type again...)
Signature · 1 line
Kees Cook
Quoted 17 lines
A "get random" may fail with a TPM error, but those codes were returned as-is to the caller, which assumed the result was the number of bytes that had been written to the target buffer, which could lead to a kernel heap memory exposure and over-read.
This fixes
tpm1_get_random()to mask positive TPM errors into-EIO, as before.[ 18.092103] tpm tpm0: A TPM error (379) occurred attempting get random [ 18.092106] usercopy: Kernel memory exposure attempt detected from SLUBobject 'kmalloc-64' (offset 0, size 379)!
Reported-by Phil Baker <[email protected]>Reported-by Craig Robson <[email protected]>Fixes 7aee9c52d7ac ("tpm: tpm1: rewrite tpm1_get_random() using tpm_bufstructure")
Quoted 8 lines
Cc Laura Abbott <[email protected]>Cc Tomas Winkler <[email protected]>Cc Jarkko Sakkinen <[email protected]>Signed-off-by Kees Cook <[email protected]>---
v3: fix never-succeed, limit checks to tpm cmd return (James, Jason)
v2: also fix tpm2 implementation (Jason Gunthorpe)
Looks good to me.
Thanks
Tomas
Quoted 64 lines
--- drivers/char/tpm/tpm1-cmd.c | 7 +++++-- drivers/char/tpm/tpm2-cmd.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-)drivers/char/tpm/tpm1-cmd.c +1
-1@@ -510,7 +510,7 @@ struct tpm1_get_random_out {* * Return: * * number of bytes read -* * -errno or a TPM return code otherwise +* * -errno (positive TPM return codes are masked to -EIO) */ int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max) { @@ - 531,8 +531,11 @@ int tpm1_get_random(struct tpm_chip *chip, u8 *dest,
size_tmax)drivers/char/tpm/tpm1-cmd.c +4
-1rc =tpm_transmit_cmd (chip, &buf,sizeof (out->rng_data_len),"attempting get random" ); -if (rc) +if (rc) { +if (rc >0 ) + rc = -EIO ; goto out; + } out = (struct tpm1_get_random_out*)&buf.data[TPM_HEADER_SIZE];
drivers/char/tpm/tpm2-cmd.c +1
-1@@ -301,7 +301,7 @@ struct tpm2_get_random_out {* * Return: * size of the buffer on success, -* -errno otherwise +* -errno otherwise ((positive TPM return codes are masked to -EIO) */ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) { @@ - 328,8 +328,11 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest,
size_tmax)drivers/char/tpm/tpm2-cmd.c +4
-2offsetof(struct tpm2_get_random_out , buffer), "attempting get random"); -if (err) +if (err) { +if (err >0 ) + err = -EIO ; goto out; + } out = (struct tpm2_get_random_out *) &buf.data[TPM_HEADER_SIZE ]; --2.17.1
--
Kees Cook
Quoted 86 lines · Kees Cook
A "get random" may fail with a TPM error, but those codes were returned as-is to the caller, which assumed the result was the number of bytes that had been written to the target buffer, which could lead to a kernel heap memory exposure and over-read.
This fixes
tpm1_get_random()to mask positive TPM errors into-EIO, as before.[ 18.092103] tpm tpm0: A TPM error (379) occurred attempting get random [ 18.092106] usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-64' (offset 0, size 379)!Reported-by Phil Baker <[email protected]>Reported-by Craig Robson <[email protected]>Fixes 7aee9c52d7ac ("tpm: tpm1: rewrite tpm1_get_random() using tpm_buf structure")Cc Laura Abbott <[email protected]>Cc Tomas Winkler <[email protected]>Cc Jarkko Sakkinen <[email protected]>Signed-off-by Kees Cook <[email protected]>---
v3: fix never-succeed, limit checks to tpm cmd return (James, Jason)
v2: also fix tpm2 implementation (Jason Gunthorpe)--- drivers/char/tpm/tpm1-cmd.c | 7 +++++-- drivers/char/tpm/tpm2-cmd.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-)drivers/char/tpm/tpm1-cmd.c +5
-2@@ -510,7 +510,7 @@ struct tpm1_get_random_out {* * Return: * * number of bytes read -* * -errno or a TPM return code otherwise +* * -errno (positive TPM return codes are masked to -EIO) */ int tpm1_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {@@ -531,8 +531,11 @@ int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max) rc =tpm_transmit_cmd (chip, &buf,sizeof (out->rng_data_len),"attempting get random" ); -if (rc) +if (rc) { +if (rc >0 ) + rc = -EIO ; goto out; + } out = (struct tpm1_get_random_out *)&buf.data[TPM_HEADER_SIZE ];drivers/char/tpm/tpm2-cmd.c +5
-2@@ -301,7 +301,7 @@ struct tpm2_get_random_out {* * Return: * size of the buffer on success, -* -errno otherwise +* -errno otherwise ((positive TPM return codes are masked to -EIO) */ int tpm2_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {@@ -328,8 +328,11 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) offsetof(struct tpm2_get_random_out , buffer), "attempting get random"); -if (err) +if (err) { +if (err >0 ) + err = -EIO ; goto out; + } out = (struct tpm2_get_random_out *) &buf.data[TPM_HEADER_SIZE ];Signature · 5 lines
2.17.1 -- Kees Cook
/Jarkko
Jarkko Sakkinen
AppliedQuoted 85 lines · Jarkko Sakkinen
Quoted 84 lines · Kees Cook
A "get random" may fail with a TPM error, but those codes were returned as-is to the caller, which assumed the result was the number of bytes that had been written to the target buffer, which could lead to a kernel heap memory exposure and over-read.
This fixes
tpm1_get_random()to mask positive TPM errors into-EIO, as before.[ 18.092103] tpm tpm0: A TPM error (379) occurred attempting get random [ 18.092106] usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-64' (offset 0, size 379)!Reported-by Phil Baker <[email protected]>Reported-by Craig Robson <[email protected]>Fixes 7aee9c52d7ac ("tpm: tpm1: rewrite tpm1_get_random() using tpm_buf structure")Cc Laura Abbott <[email protected]>Cc Tomas Winkler <[email protected]>Cc Jarkko Sakkinen <[email protected]>Signed-off-by Kees Cook <[email protected]>---
v3: fix never-succeed, limit checks to tpm cmd return (James, Jason)
v2: also fix tpm2 implementation (Jason Gunthorpe)--- drivers/char/tpm/tpm1-cmd.c | 7 +++++-- drivers/char/tpm/tpm2-cmd.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-)drivers/char/tpm/tpm1-cmd.c +5
-2@@ -510,7 +510,7 @@ struct tpm1_get_random_out {* * Return: * * number of bytes read -* * -errno or a TPM return code otherwise +* * -errno (positive TPM return codes are masked to -EIO) */ int tpm1_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {@@ -531,8 +531,11 @@ int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max) rc =tpm_transmit_cmd (chip, &buf,sizeof (out->rng_data_len),"attempting get random" ); -if (rc) +if (rc) { +if (rc >0 ) + rc = -EIO ; goto out; + } out = (struct tpm1_get_random_out *)&buf.data[TPM_HEADER_SIZE ];drivers/char/tpm/tpm2-cmd.c +5
-2@@ -301,7 +301,7 @@ struct tpm2_get_random_out {* * Return: * size of the buffer on success, -* -errno otherwise +* -errno otherwise ((positive TPM return codes are masked to -EIO) */ int tpm2_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {@@ -328,8 +328,11 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) offsetof(struct tpm2_get_random_out , buffer), "attempting get random"); -if (err) +if (err) { +if (err >0 ) + err = -EIO ; goto out; + } out = (struct tpm2_get_random_out *) &buf.data[TPM_HEADER_SIZE ];Signature · 1 line
2.17.1
Quoted 4 lines
Quoted 2 lines
Signature · 1 line
Kees CookReviewed-by Jarkko Sakkinen <[email protected]>
Applied to my master branch. Jason, Tomas, do you want me to add reviewed-by's?
/Jarkko
Quoted 94 lines · Jarkko Sakkinen
Quoted 10 lines · Kees Cook
Quoted 9 lines
A "get random" may fail with a TPM error, but those codes were returned as-is to the caller, which assumed the result was the number of bytes that had been written to the target buffer, which could lead to a kernel heap memory exposure and over-read.
This fixes
tpm1_get_random()to mask positive TPM errors into-EIO, as before.[ 18.092103] tpm tpm0: A TPM error (379) occurred attempting getrandom
Quoted 1 line
Quoted 1 line
[ 18.092106] usercopy: Kernel memory exposure attempt detected fromSLUB object 'kmalloc-64' (offset 0, size 379)!
Quoted 44 lines
Quoted 44 lines
Reported-by Phil Baker <[email protected]>Reported-by Craig Robson <[email protected]>Fixes 7aee9c52d7ac ("tpm: tpm1: rewrite tpm1_get_random() using
tpm_bufstructure")Cc Laura Abbott <[email protected]>Cc Tomas Winkler <[email protected]>Cc Jarkko Sakkinen <[email protected]>Signed-off-by Kees Cook <[email protected]>---
v3: fix never-succeed, limit checks to tpm cmd return (James, Jason)
v2: also fix tpm2 implementation (Jason Gunthorpe)--- drivers/char/tpm/tpm1-cmd.c | 7 +++++-- drivers/char/tpm/tpm2-cmd.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-)(quoted diff) +0
-0
b/drivers/char/tpm/tpm1-cmd.cindex85dcf2654d11..faacbe1ffa1a100644drivers/char/tpm/tpm1-cmd.c +5
-2@@ -510,7 +510,7 @@ struct tpm1_get_random_out {* * Return: * * number of bytes read -* * -errno or a TPM return code otherwise +* * -errno (positive TPM return codes are masked to -EIO) */ int tpm1_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {@@ -531,8 +531,11 @@ int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max) rc =tpm_transmit_cmd (chip, &buf,sizeof (out->rng_data_len),"attempting get random" ); -if (rc) +if (rc) { +if (rc >0 ) + rc = -EIO ; goto out; + }Quoted 1 line
drivers/char/tpm/tpm1-cmd.c int tpm1_get_random(struct tpm_chip *chip, u8 · line 541
Quoted 1 line
drivers/char/tpm/tpm1-cmd.c +0
-0out = (struct tpm1_get_random_out*)&buf.data[TPM_HEADER_SIZE];
Quoted 15 lines
drivers/char/tpm/tpm2-cmd.c int tpm2_get_random(struct tpm_chip *chip, u8
Quoted 15 lines
(quoted diff) +0
-0
b/drivers/char/tpm/tpm2-cmd.cindexe74c5b7b64bf..8ffa6af61580100644drivers/char/tpm/tpm2-cmd.c +1
-1@@ -301,7 +301,7 @@ struct tpm2_get_random_out {* * Return: * size of the buffer on success, -* -errno otherwise +* -errno otherwise ((positive TPM return codes are masked to -EIO) */ int tpm2_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {@@ -328,8 +328,11 @@ int tpm2_get_random(struct tpm_chip *chip, u8*dest,
size_tmax)Quoted 16 lines
Quoted 16 lines
drivers/char/tpm/tpm2-cmd.c +4
-2offsetof(struct tpm2_get_random_out , buffer), "attempting get random"); -if (err) +if (err) { +if (err >0 ) + err = -EIO ; goto out; + } out = (struct tpm2_get_random_out *) &buf.data[TPM_HEADER_SIZE ]; --2.17.1
Quoted 7 lines
Quoted 4 lines
Quoted 2 lines
--
Kees CookReviewed-by Jarkko Sakkinen <[email protected]>Applied to my master branch. Jason, Tomas, do you want me to add reviewed- by's?
Sure, it fixes my patch.
Quoted 1 line
/Jarkko
Quoted 94 lines · Tomas
Quoted 94 lines · Jarkko Sakkinen
Quoted 10 lines · Kees Cook
Quoted 9 lines
A "get random" may fail with a TPM error, but those codes were returned as-is to the caller, which assumed the result was the number of bytes that had been written to the target buffer, which could lead to a kernel heap memory exposure and over-read.
This fixes
tpm1_get_random()to mask positive TPM errors into-EIO, as before.[ 18.092103] tpm tpm0: A TPM error (379) occurred attempting getrandom
Quoted 1 line
Quoted 1 line
[ 18.092106] usercopy: Kernel memory exposure attempt detected fromSLUB object 'kmalloc-64' (offset 0, size 379)!
Quoted 44 lines
Quoted 44 lines
Reported-by Phil Baker <[email protected]>Reported-by Craig Robson <[email protected]>Fixes 7aee9c52d7ac ("tpm: tpm1: rewrite tpm1_get_random() using
tpm_bufstructure")Cc Laura Abbott <[email protected]>Cc Tomas Winkler <[email protected]>Cc Jarkko Sakkinen <[email protected]>Signed-off-by Kees Cook <[email protected]>---
v3: fix never-succeed, limit checks to tpm cmd return (James, Jason)
v2: also fix tpm2 implementation (Jason Gunthorpe)--- drivers/char/tpm/tpm1-cmd.c | 7 +++++-- drivers/char/tpm/tpm2-cmd.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-)(quoted diff) +0
-0
b/drivers/char/tpm/tpm1-cmd.cindex85dcf2654d11..faacbe1ffa1a100644drivers/char/tpm/tpm1-cmd.c +5
-2@@ -510,7 +510,7 @@ struct tpm1_get_random_out {* * Return: * * number of bytes read -* * -errno or a TPM return code otherwise +* * -errno (positive TPM return codes are masked to -EIO) */ int tpm1_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {@@ -531,8 +531,11 @@ int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max) rc =tpm_transmit_cmd (chip, &buf,sizeof (out->rng_data_len),"attempting get random" ); -if (rc) +if (rc) { +if (rc >0 ) + rc = -EIO ; goto out; + }Quoted 1 line
drivers/char/tpm/tpm1-cmd.c int tpm1_get_random(struct tpm_chip *chip, u8 · line 541
Quoted 1 line
drivers/char/tpm/tpm1-cmd.c +0
-0out = (struct tpm1_get_random_out*)&buf.data[TPM_HEADER_SIZE];
Quoted 15 lines
drivers/char/tpm/tpm2-cmd.c int tpm2_get_random(struct tpm_chip *chip, u8
Quoted 15 lines
(quoted diff) +0
-0
b/drivers/char/tpm/tpm2-cmd.cindexe74c5b7b64bf..8ffa6af61580100644drivers/char/tpm/tpm2-cmd.c +1
-1@@ -301,7 +301,7 @@ struct tpm2_get_random_out {* * Return: * size of the buffer on success, -* -errno otherwise +* -errno otherwise ((positive TPM return codes are masked to -EIO) */ int tpm2_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {@@ -328,8 +328,11 @@ int tpm2_get_random(struct tpm_chip *chip, u8*dest,
size_tmax)Quoted 16 lines
Quoted 16 lines
drivers/char/tpm/tpm2-cmd.c +4
-2offsetof(struct tpm2_get_random_out , buffer), "attempting get random"); -if (err) +if (err) { +if (err >0 ) + err = -EIO ; goto out; + } out = (struct tpm2_get_random_out *) &buf.data[TPM_HEADER_SIZE ]; --2.17.1
Quoted 8 lines
Quoted 7 lines
Quoted 4 lines
Quoted 2 lines
--
Kees CookReviewed-by Jarkko Sakkinen <[email protected]>Applied to my master branch. Jason, Tomas, do you want me to add reviewed- by's?
Sure, it fixes my patch.
Great, I'll add it. Thank you. Just want to be explicit with these things as I consider them as if I was asking a signature from someone :-)
/Jarkko
Quoted 102 lines · Jarkko Sakkinen
Quoted 101 lines · Tomas
Quoted 101 lines · Jarkko Sakkinen
Quoted 10 lines · Kees Cook
Quoted 9 lines
A "get random" may fail with a TPM error, but those codes were returned as-is to the caller, which assumed the result was the number of bytes that had been written to the target buffer, which could lead to a kernel heap memory exposure and over-read.
This fixes
tpm1_get_random()to mask positive TPM errors into-EIO, as before.[ 18.092103] tpm tpm0: A TPM error (379) occurred attempting getrandom
Quoted 1 line
Quoted 1 line
[ 18.092106] usercopy: Kernel memory exposure attempt detected fromSLUB object 'kmalloc-64' (offset 0, size 379)!
Quoted 44 lines
Quoted 44 lines
Reported-by Phil Baker <[email protected]>Reported-by Craig Robson <[email protected]>Fixes 7aee9c52d7ac ("tpm: tpm1: rewrite tpm1_get_random() using
tpm_bufstructure")Cc Laura Abbott <[email protected]>Cc Tomas Winkler <[email protected]>Cc Jarkko Sakkinen <[email protected]>Signed-off-by Kees Cook <[email protected]>---
v3: fix never-succeed, limit checks to tpm cmd return (James, Jason)
v2: also fix tpm2 implementation (Jason Gunthorpe)--- drivers/char/tpm/tpm1-cmd.c | 7 +++++-- drivers/char/tpm/tpm2-cmd.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-)(quoted diff) +0
-0
b/drivers/char/tpm/tpm1-cmd.cindex85dcf2654d11..faacbe1ffa1a100644drivers/char/tpm/tpm1-cmd.c +5
-2@@ -510,7 +510,7 @@ struct tpm1_get_random_out {* * Return: * * number of bytes read -* * -errno or a TPM return code otherwise +* * -errno (positive TPM return codes are masked to -EIO) */ int tpm1_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {@@ -531,8 +531,11 @@ int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max) rc =tpm_transmit_cmd (chip, &buf,sizeof (out->rng_data_len),"attempting get random" ); -if (rc) +if (rc) { +if (rc >0 ) + rc = -EIO ; goto out; + }Quoted 1 line
drivers/char/tpm/tpm1-cmd.c int tpm1_get_random(struct tpm_chip *chip, u8 · line 541
Quoted 1 line
drivers/char/tpm/tpm1-cmd.c +0
-0out = (struct tpm1_get_random_out*)&buf.data[TPM_HEADER_SIZE];
Quoted 15 lines
drivers/char/tpm/tpm2-cmd.c int tpm2_get_random(struct tpm_chip *chip, u8
Quoted 15 lines
(quoted diff) +0
-0
b/drivers/char/tpm/tpm2-cmd.cindexe74c5b7b64bf..8ffa6af61580100644drivers/char/tpm/tpm2-cmd.c +1
-1@@ -301,7 +301,7 @@ struct tpm2_get_random_out {* * Return: * size of the buffer on success, -* -errno otherwise +* -errno otherwise ((positive TPM return codes are masked to -EIO) */ int tpm2_get_random (struct tpm_chip *chip,u8 *dest,size_t max) {@@ -328,8 +328,11 @@ int tpm2_get_random(struct tpm_chip *chip, u8*dest,
size_tmax)Quoted 16 lines
Quoted 16 lines
drivers/char/tpm/tpm2-cmd.c +4
-2offsetof(struct tpm2_get_random_out , buffer), "attempting get random"); -if (err) +if (err) { +if (err >0 ) + err = -EIO ; goto out; + } out = (struct tpm2_get_random_out *) &buf.data[TPM_HEADER_SIZE ]; --2.17.1
Quoted 4 lines
Quoted 2 lines
--
Kees CookReviewed-by Jarkko Sakkinen <[email protected]>Applied to my master branch. Jason, Tomas, do you want me to add reviewed- by's?
Quoted 8 lines
Quoted 1 line
Sure, it fixes my patch.
Great, I'll add it. Thank you. Just want to be explicit with these things as I consider them as if I was asking a signature from someone :-)
/Jarkko
Was this intended to go in for 5.2? I still don't see it in the tree.
Thanks,
Laura
Quoted 7 lines · Laura Abbott
Quoted 6 lines
Great, I'll add it. Thank you. Just want to be explicit with these things as I consider them as if I was asking a signature from someone :-)
/Jarkko
Was this intended to go in for 5.2? I still don't see it in the tree.
Was intended but I failed to notice that I should start to send PRs to Linus instead of security tree and was waiting for security tree to be rebased. I'll include to the next PR.
/Jarkko