linux.git/drivers/char/tpm, branch v3.18.128

tpm_i2c_nuvoton: fix potential buffer overruns caused by bit glitches on the bus

2018-03-11T15:12:17+00:00

commit f9d4d9b5a5ef2f017bc344fb65a58a902517173b upstream.

Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips.  In all the
driver _recv() functions, we need to use a u32 to unmarshal the
response size, otherwise a bit flip of the 31st bit would cause the
expected variable to go negative, which would then try to read a huge
amount of data.  Also sanity check that the expected amount of data is
large enough for the TPM header.

Signed-off-by: Jeremy Boone 
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley 
Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

tpm_i2c_infineon: fix potential buffer overruns caused by bit glitches on the bus

2018-03-11T15:12:17+00:00

commit 9b8cb28d7c62568a5916bdd7ea1c9176d7f8f2ed upstream.

Discrete TPMs are often connected over slow serial buses which, on
some platforms, can have glitches causing bit flips.  In all the
driver _recv() functions, we need to use a u32 to unmarshal the
response size, otherwise a bit flip of the 31st bit would cause the
expected variable to go negative, which would then try to read a huge
amount of data.  Also sanity check that the expected amount of data is
large enough for the TPM header.

Signed-off-by: Jeremy Boone 
Cc: stable@vger.kernel.org
Signed-off-by: James Bottomley 
Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

tpm: fix a kernel memory leak in tpm-sysfs.c

2017-08-11T16:30:11+00:00

commit 13b47cfcfc60495cde216eef4c01040d76174cbe upstream.

While cleaning up sysfs callback that prints EK we discovered a kernel
memory leak. This commit fixes the issue by zeroing the buffer used for
TPM command/response.

The leak happen when we use either tpm_vtpm_proxy, tpm_ibmvtpm or
xen-tpmfront.

Cc: stable@vger.kernel.org
Fixes: 0883743825e3 ("TPM: sysfs functions consolidation")
Reported-by: Jason Gunthorpe 
Tested-by: Stefan Berger 
Signed-off-by: Jarkko Sakkinen 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

vTPM: set virtual device before passing to ibmvtpm_reset_crq

2015-07-04T03:02:31+00:00

[ Upstream commit 9d75f08946e8485109458ccf16f714697c207f41 ]

tpm_ibmvtpm_probe() calls ibmvtpm_reset_crq(ibmvtpm) without having yet
set the virtual device in the ibmvtpm structure. So in ibmvtpm_reset_crq,
the phype call contains empty unit addresses, ibmvtpm->vdev->unit_address.

Signed-off-by: Hon Ching(Vicky) Lo 
Signed-off-by: Joy Latten 
Reviewed-by: Ashley Lai 
Cc: 
Fixes: 132f76294744 ("drivers/char/tpm: Add new device driver to support IBM vTPM")
Signed-off-by: Peter Huewe 
Signed-off-by: Sasha Levin

tpm/tpm_i2c_stm_st33: Add status check when reading data on the FIFO

2015-03-28T13:43:13+00:00

[ Upstream commit c4eadfafb91d5501095c55ffadaa1168743f39d3 ]

Add a return value check when reading data from the FIFO register.

Cc: 
Reviewed-by: Jason Gunthorpe 
Signed-off-by: Christophe Ricard 
Reviewed-by: Peter Huewe 
Signed-off-by: Peter Huewe 
Signed-off-by: Sasha Levin

tpm/ibmvtpm: Additional LE support for tpm_ibmvtpm_send

2015-03-28T13:43:06+00:00

[ Upstream commit 62dfd912ab3b5405b6fe72d0135c37e9648071f1 ]

Problem: When IMA and VTPM are both enabled in kernel config,
kernel hangs during bootup on LE OS.

Why?: IMA calls tpm_pcr_read() which results in tpm_ibmvtpm_send
and tpm_ibmtpm_recv getting called. A trace showed that
tpm_ibmtpm_recv was hanging.

Resolution: tpm_ibmtpm_recv was hanging because tpm_ibmvtpm_send
was sending CRQ message that probably did not make much sense
to phype because of Endianness. The fix below sends correctly
converted CRQ for LE. This was not caught before because it
seems IMA is not enabled by default in kernel config and
IMA exercises this particular code path in vtpm.

Tested with IMA and VTPM enabled in kernel config and VTPM
enabled on both a BE OS and a LE OS ppc64 lpar. This exercised
CRQ and TPM command code paths in vtpm.
Patch is against Peter's tpmdd tree on github which included
Vicky's previous vtpm le patches.

Signed-off-by: Joy Latten 
Cc:  # eb71f8a5e33f: "Added Little Endian support to vtpm module"
Cc: 
Reviewed-by: Ashley Lai 
Signed-off-by: Peter Huewe 
Signed-off-by: Sasha Levin

Added Little Endian support to vtpm module

2015-03-06T22:52:58+00:00

commit eb71f8a5e33fa1066fb92f0111ab366a341e1f6c upstream.

The tpm_ibmvtpm module is affected by an unaligned access problem.
ibmvtpm_crq_get_version failed with rc=-4 during boot when vTPM is
enabled in Power partition, which supports both little endian and
big endian modes.

We added little endian support to fix this problem:
1) added cpu_to_be64 calls to ensure BE data is sent from an LE OS.
2) added be16_to_cpu and be32_to_cpu calls to make sure data received
   is in LE format on a LE OS.

Signed-off-by: Hon Ching(Vicky) Lo 
Signed-off-by: Joy Latten 
[phuewe: manually applied the patch :( ]
Reviewed-by: Ashley Lai 
Signed-off-by: Peter Huewe 
Signed-off-by: Greg Kroah-Hartman

tpm/tpm_i2c_stm_st33: Fix potential bug in tpm_stm_i2c_send

2015-03-06T22:52:57+00:00

commit 1ba3b0b6f218072afe8372d12f1b6bf26a26008e upstream.

When sending data in tpm_stm_i2c_send, each loop iteration send buf.
Send buf + i instead as the goal of this for loop is to send a number
of byte from buf that fit in burstcnt. Once those byte are sent, we are
supposed to send the next ones.

The driver was working because the burstcount value returns always the maximum size for a TPM
command or response. (0x800 for a command and 0x400 for a response).

Reviewed-by: Jason Gunthorpe 
Signed-off-by: Christophe Ricard 
Signed-off-by: Peter Huewe 
Signed-off-by: Greg Kroah-Hartman

tpm: Fix NULL return in tpm_ibmvtpm_get_desired_dma

2015-03-06T22:52:57+00:00

commit 84eb186bc37c0900b53077ca21cf6dd15823a232 upstream.

There was an oops in tpm_ibmvtpm_get_desired_dma, which caused
kernel panic during boot when vTPM is enabled in Power partition
configured in AMS mode.

vio_bus_probe calls vio_cmo_bus_probe which calls
tpm_ibmvtpm_get_desired_dma to get the size needed for DMA allocation.
The problem is, vio_cmo_bus_probe is called before calling probe, which
for vtpm is tpm_ibmvtpm_probe and it's this function that initializes
and sets up vtpm's CRQ and gets required data values.  Therefore,
since this has not yet been done, NULL is returned in attempt to get
the size for DMA allocation.

We added a NULL check.  In addition, a default buffer size will
be set when NULL is returned.

Signed-off-by: Hon Ching (Vicky) Lo 
Signed-off-by: Peter Huewe 
Signed-off-by: Greg Kroah-Hartman

char: tpm: Add missing error check for devm_kzalloc

2015-03-06T22:52:57+00:00

commit bb95cd34ba4c9467114acc78eeddd53ab1c10085 upstream.

Currently these driver are missing a check on the return value of devm_kzalloc,
which would cause a NULL pointer dereference in a OOM situation.

This patch adds a missing check for tpm_i2c_atmel.c and tpm_i2c_nuvoton.c

Signed-off-by: Kiran Padwal 
Reviewed-By: Jason Gunthorpe 
Signed-off-by: Peter Huewe 
Signed-off-by: Greg Kroah-Hartman