Commit bda1cbf7 authored by Jarkko Sakkinen's avatar Jarkko Sakkinen
Browse files

tpm2-sessions: Fix tpm2_read_public range checks 



tpm2_read_public() has some rudimentary range checks but the function does
not ensure that the response buffer has enough bytes for the full TPMT_HA
payload.

Re-implement the function with necessary checks and validation, and return
name and name size for all handle types back to the caller.

Cc: stable@vger.kernel.org # v6.10+
Fixes: d0a25bb9 ("tpm: Add HMAC session name/handle append")
Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
Reviewed-by: default avatarJonathan McDowell <noodles@meta.com>
parent 6e9722e9

drivers/char/tpm/tpm2-cmd.c

+3 −0
Original line number Diff line number Diff line
@@ -11,8 +11,11 @@ 
 * used by the kernel internally.

 */



#include "linux/dev_printk.h"

#include "linux/tpm.h"

#include "tpm.h"

#include <crypto/hash_info.h>

#include <linux/unaligned.h>



static bool disable_pcr_integrity;

module_param(disable_pcr_integrity, bool, 0444);

drivers/char/tpm/tpm2-sessions.c

+50 −44
Original line number Diff line number Diff line
@@ -163,53 +163,61 @@ static int name_size(const u8 *name) 
	}

}



static int tpm2_parse_read_public(char *name, struct tpm_buf *buf)

static int tpm2_read_public(struct tpm_chip *chip, u32 handle, void *name)

{

	struct tpm_header *head = (struct tpm_header *)buf->data;

	u32 mso = tpm2_handle_mso(handle);

	off_t offset = TPM_HEADER_SIZE;

	u32 tot_len = be32_to_cpu(head->length);

	int ret;

	u32 val;



	/* we're starting after the header so adjust the length */

	tot_len -= TPM_HEADER_SIZE;



	/* skip public */

	val = tpm_buf_read_u16(buf, &offset);

	if (val > tot_len)

		return -EINVAL;

	offset += val;

	/* name */

	val = tpm_buf_read_u16(buf, &offset);

	ret = name_size(&buf->data[offset]);

	if (ret < 0)

		return ret;



	if (val != ret)

		return -EINVAL;

	int rc, name_size_alg;

	struct tpm_buf buf;



	memcpy(name, &buf->data[offset], val);

	/* forget the rest */

	return 0;

	if (mso != TPM2_MSO_PERSISTENT && mso != TPM2_MSO_VOLATILE &&

	    mso != TPM2_MSO_NVRAM) {

		memcpy(name, &handle, sizeof(u32));

		return sizeof(u32);

	}



static int tpm2_read_public(struct tpm_chip *chip, u32 handle, char *name)

{

	struct tpm_buf buf;

	int rc;



	rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_READ_PUBLIC);

	if (rc)

		return rc;



	tpm_buf_append_u32(&buf, handle);

	rc = tpm_transmit_cmd(chip, &buf, 0, "read public");

	if (rc == TPM2_RC_SUCCESS)

		rc = tpm2_parse_read_public(name, &buf);



	rc = tpm_transmit_cmd(chip, &buf, 0, "TPM2_ReadPublic");

	if (rc) {

		tpm_buf_destroy(&buf);

		return tpm_ret_to_err(rc);

	}



	/* Skip TPMT_PUBLIC: */

	offset += tpm_buf_read_u16(&buf, &offset);



	/*

	 * Ensure space for the length field of TPM2B_NAME and hashAlg field of

	 * TPMT_HA (the extra four bytes).

	 */

	if (offset + 4 > tpm_buf_length(&buf)) {

		tpm_buf_destroy(&buf);

		return -EIO;

	}



	return rc;

	rc = tpm_buf_read_u16(&buf, &offset);

	name_size_alg = name_size(&buf.data[offset]);



	if (name_size_alg < 0)

		return name_size_alg;



	if (rc != name_size_alg) {

		tpm_buf_destroy(&buf);

		return -EIO;

	}



	if (offset + rc > tpm_buf_length(&buf)) {

		tpm_buf_destroy(&buf);

		return -EIO;

	}



	memcpy(name, &buf.data[offset], rc);

	return name_size_alg;

}

#endif /* CONFIG_TCG_TPM2_HMAC */
@@ -243,6 +251,7 @@ int tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, 
#ifdef CONFIG_TCG_TPM2_HMAC

	enum tpm2_mso_type mso = tpm2_handle_mso(handle);

	struct tpm2_auth *auth;

	u16 name_size_alg;

	int slot;

	int ret;

#endif
@@ -273,8 +282,10 @@ int tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, 
	    mso == TPM2_MSO_NVRAM) {

		if (!name) {

			ret = tpm2_read_public(chip, handle, auth->name[slot]);

			if (ret)

			if (ret < 0)

				goto err;



			name_size_alg = ret;

		}

	} else {

		if (name) {
@@ -286,13 +297,8 @@ int tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, 
	}



	auth->name_h[slot] = handle;

	if (name) {

		ret = name_size(name);

		if (ret < 0)

			goto err;



		memcpy(auth->name[slot], name, ret);

	}

	if (name)

		memcpy(auth->name[slot], name, name_size_alg);

#endif

	return 0;