From patchwork Thu Jan 28 23:56:19 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarkko Sakkinen X-Patchwork-Id: 373782 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.3 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5283BC433E6 for ; Thu, 28 Jan 2021 23:57:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 1522964E01 for ; Thu, 28 Jan 2021 23:57:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229825AbhA1X5O (ORCPT ); Thu, 28 Jan 2021 18:57:14 -0500 Received: from mail.kernel.org ([198.145.29.99]:57446 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229530AbhA1X5N (ORCPT ); Thu, 28 Jan 2021 18:57:13 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 91BEC64DFF; Thu, 28 Jan 2021 23:56:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1611878192; bh=wP+Nl3jUZAq7xkUZsNf6xweQEVJK89APxRPIbA2w5io=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EGHJX1TlKVUnsL/qT5K44crE4XuWmKk6+KzBRnjQGUU2OgM0XfTQ62bzVlZTcs2Wt gh88uWFjEGevpaVY4T3dxN418TU0rnxu9ZHvysE7eSvw6ZghjxN6ASK/WXkLljrBQA B/0VzBDRYyQ6f3dycLmyO1eyQ28hf9PO7anBTStmzx4ND4I+25yb7jAt3jXL0GRIS1 P1mNb0f8J4Oi52L1n20EFhuTiy04LJuDTevdvCZHIav/DVMEprXMOp7Yk0W5HslWsf EgDOnRKMXxXfwNZE4FOEEPaS7oM4px0ySHjOB0jphBhDhO943+nnV2ap1SAJ0wMAl9 nmfbUgCQiOwlw== From: jarkko@kernel.org To: linux-integrity@vger.kernel.org Cc: Jarkko Sakkinen , stable@vger.kernel.org, Mimi Zohar , "James E.J. Bottomley" , David Howells , Kent Yoder , James Bottomley , James Morris , "Serge E. Hallyn" , David Safford , "H. Peter Anvin" Subject: [PATCH v5 1/3] KEYS: trusted: Fix incorrect handling of tpm_get_random() Date: Fri, 29 Jan 2021 01:56:19 +0200 Message-Id: <20210128235621.127925-2-jarkko@kernel.org> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210128235621.127925-1-jarkko@kernel.org> References: <20210128235621.127925-1-jarkko@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jarkko Sakkinen When tpm_get_random() was introduced, it defined the following API for the return value: 1. A positive value tells how many bytes of random data was generated. 2. A negative value on error. However, in the call sites the API was used incorrectly, i.e. as it would only return negative values and otherwise zero. Returning he positive read counts to the user space does not make any possible sense. Fix this by returning -EIO when tpm_get_random() returns a positive value. Fixes: 41ab999c80f1 ("tpm: Move tpm_get_random api into the TPM device driver") Cc: stable@vger.kernel.org Cc: Mimi Zohar Cc: "James E.J. Bottomley" Cc: David Howells Cc: Kent Yoder Signed-off-by: Jarkko Sakkinen Reviewed-by: Mimi Zohar --- security/keys/trusted-keys/trusted_tpm1.c | 20 +++++++++++++++++--- 1 file changed, 17 insertions(+), 3 deletions(-) diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c index 74d82093cbaa..204826b734ac 100644 --- a/security/keys/trusted-keys/trusted_tpm1.c +++ b/security/keys/trusted-keys/trusted_tpm1.c @@ -403,9 +403,12 @@ static int osap(struct tpm_buf *tb, struct osapsess *s, int ret; ret = tpm_get_random(chip, ononce, TPM_NONCE_SIZE); - if (ret != TPM_NONCE_SIZE) + if (ret < 0) return ret; + if (ret != TPM_NONCE_SIZE) + return -EIO; + tpm_buf_reset(tb, TPM_TAG_RQU_COMMAND, TPM_ORD_OSAP); tpm_buf_append_u16(tb, type); tpm_buf_append_u32(tb, handle); @@ -496,8 +499,12 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype, goto out; ret = tpm_get_random(chip, td->nonceodd, TPM_NONCE_SIZE); + if (ret < 0) + return ret; + if (ret != TPM_NONCE_SIZE) - goto out; + return -EIO; + ordinal = htonl(TPM_ORD_SEAL); datsize = htonl(datalen); pcrsize = htonl(pcrinfosize); @@ -601,9 +608,12 @@ static int tpm_unseal(struct tpm_buf *tb, ordinal = htonl(TPM_ORD_UNSEAL); ret = tpm_get_random(chip, nonceodd, TPM_NONCE_SIZE); + if (ret < 0) + return ret; + if (ret != TPM_NONCE_SIZE) { pr_info("trusted_key: tpm_get_random failed (%d)\n", ret); - return ret; + return -EIO; } ret = TSS_authhmac(authdata1, keyauth, TPM_NONCE_SIZE, enonce1, nonceodd, cont, sizeof(uint32_t), @@ -1013,8 +1023,12 @@ static int trusted_instantiate(struct key *key, case Opt_new: key_len = payload->key_len; ret = tpm_get_random(chip, payload->key, key_len); + if (ret < 0) + goto out; + if (ret != key_len) { pr_info("trusted_key: key_create failed (%d)\n", ret); + ret = -EIO; goto out; } if (tpm2) From patchwork Thu Jan 28 23:56:20 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarkko Sakkinen X-Patchwork-Id: 373246 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.3 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5C9EAC433E9 for ; Thu, 28 Jan 2021 23:57:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 2EF5564DFD for ; Thu, 28 Jan 2021 23:57:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231124AbhA1X5R (ORCPT ); Thu, 28 Jan 2021 18:57:17 -0500 Received: from mail.kernel.org ([198.145.29.99]:57476 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229530AbhA1X5Q (ORCPT ); Thu, 28 Jan 2021 18:57:16 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id 4D2B264E02; Thu, 28 Jan 2021 23:56:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1611878196; bh=ylgnRUcnVlVEML2L+Q2zHIzNb950gPDfnP5/qgF/5w4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YrXiXIFh00kcRXXhwlDNHvOsGwjKIUQRm6utI+7ZdNn7j9oJUD08YmHca09c1IFpy u1nw3foOBBbMWENLvh14Mlsdix5T6w7L/No8seRBiZwWAlslDfZqcjG9nR9QzUPQeW oZaZTHmKkUtg79fbEG4I4yRnfzl75qotps92HDszaiQLcDtuFWfddFgaBCp/30lVV2 zSt0ZkDCy45HRZicfCotPpVaR40gYHGNGJUxPrvh2lZA2Rpi4WKF+g9Z5vJgVNqvME Ku2THvdD3wta9hphXawto1ZpU9kJzrRui0I9uAxmeq0g0qLyVkjvmZ2cj0E9wg5xsB xQf/k3DkORaPQ== From: jarkko@kernel.org To: linux-integrity@vger.kernel.org Cc: Jarkko Sakkinen , stable@vger.kernel.org, "James E.J. Bottomley" , Mimi Zohar , David Howells , James Morris , "Serge E. Hallyn" , David Safford Subject: [PATCH v5 2/3] KEYS: trusted: Fix migratable=1 failing Date: Fri, 29 Jan 2021 01:56:20 +0200 Message-Id: <20210128235621.127925-3-jarkko@kernel.org> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210128235621.127925-1-jarkko@kernel.org> References: <20210128235621.127925-1-jarkko@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jarkko Sakkinen Consider the following transcript: $ keyctl add trusted kmk "new 32 blobauth=helloworld keyhandle=80000000 migratable=1" @u add_key: Invalid argument The documentation has the following description: migratable= 0|1 indicating permission to reseal to new PCR values, default 1 (resealing allowed) The consequence is that "migratable=1" should succeed. Fix this by allowing this condition to pass instead of return -EINVAL. [*] Documentation/security/keys/trusted-encrypted.rst Cc: stable@vger.kernel.org Cc: "James E.J. Bottomley" Cc: Mimi Zohar Cc: David Howells Fixes: d00a1c72f7f4 ("keys: add new trusted key-type") Signed-off-by: Jarkko Sakkinen Reviewed-by: Mimi Zohar --- security/keys/trusted-keys/trusted_tpm1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c index 204826b734ac..493eb91ed017 100644 --- a/security/keys/trusted-keys/trusted_tpm1.c +++ b/security/keys/trusted-keys/trusted_tpm1.c @@ -801,7 +801,7 @@ static int getoptions(char *c, struct trusted_key_payload *pay, case Opt_migratable: if (*args[0].from == '0') pay->migratable = 0; - else + else if (*args[0].from != '1') return -EINVAL; break; case Opt_pcrlock: From patchwork Thu Jan 28 23:56:21 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jarkko Sakkinen X-Patchwork-Id: 373245 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.3 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, INCLUDES_CR_TRAILER, INCLUDES_PATCH, MAILING_LIST_MULTI, SPF_HELO_NONE, SPF_PASS, URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C130EC4332D for ; Thu, 28 Jan 2021 23:57:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9ED5B64DFF for ; Thu, 28 Jan 2021 23:57:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231237AbhA1X5X (ORCPT ); Thu, 28 Jan 2021 18:57:23 -0500 Received: from mail.kernel.org ([198.145.29.99]:57518 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229828AbhA1X5W (ORCPT ); Thu, 28 Jan 2021 18:57:22 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id A91D164E01; Thu, 28 Jan 2021 23:56:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1611878201; bh=pCg8FebbkyCbdo17dXGf3FV8b5El/fzjfwQHCFwObw8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rVkG5YboJScneWl7PuCuCn/CF0iM1A3JBMxbDrwEFdgPWZzR66Y2L1C9FVEIDgJCN MH7Snmhl3E78b8G30yh0VJ6fWBhGPbI9mw7C+ZwwxXgnivHYQBZKA27aG0e+B9ybcg MGt0hVyvkJ69oMYNkJ7CXpc4iVXoN3tW3738HBZxklpR2DgWUY9n4Sl2Wl6IrRBRb2 jIdDgx7GeHcwctEecf/5GBaLVQ3jduLAqlpzehh9gu36T0a86HyehGGlZsnnVH+BsC vbDJ968UcHw4HNtO4eO6vmCCDkL19mz0jrPEqb47zMbxKDJSPmawzqsgqoBL+a8s51 /960jrrA/IwaQ== From: jarkko@kernel.org To: linux-integrity@vger.kernel.org Cc: Jarkko Sakkinen , "James E.J. Bottomley" , stable@vger.kernel.org, David Howells , Mimi Zohar , Sumit Garg , Peter Huewe , Jason Gunthorpe , James Bottomley , James Morris , "Serge E. Hallyn" Subject: [PATCH v5 3/3] KEYS: trusted: Reserve TPM for seal and unseal operations Date: Fri, 29 Jan 2021 01:56:21 +0200 Message-Id: <20210128235621.127925-4-jarkko@kernel.org> X-Mailer: git-send-email 2.30.0 In-Reply-To: <20210128235621.127925-1-jarkko@kernel.org> References: <20210128235621.127925-1-jarkko@kernel.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org From: Jarkko Sakkinen When TPM 2.0 trusted keys code was moved to the trusted keys subsystem, the operations were unwrapped from tpm_try_get_ops() and tpm_put_ops(), which are used to take temporarily the ownership of the TPM chip. The ownership is only taken inside tpm_send(), but this is not sufficient, as in the key load TPM2_CC_LOAD, TPM2_CC_UNSEAL and TPM2_FLUSH_CONTEXT need to be done as a one single atom. Take the TPM chip ownership before sending anything with tpm_try_get_ops() and tpm_put_ops(), and use tpm_transmit_cmd() to send TPM commands instead of tpm_send(), reverting back to the old behaviour. Fixes: 2e19e10131a0 ("KEYS: trusted: Move TPM2 trusted keys code") Reported-by: "James E.J. Bottomley" Cc: stable@vger.kernel.org Cc: David Howells Cc: Mimi Zohar Cc: Sumit Garg Signed-off-by: Jarkko Sakkinen --- drivers/char/tpm/tpm.h | 4 ---- include/linux/tpm.h | 5 ++++- security/keys/trusted-keys/trusted_tpm2.c | 24 ++++++++++++++++++----- 3 files changed, 23 insertions(+), 10 deletions(-) diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h index 947d1db0a5cc..283f78211c3a 100644 --- a/drivers/char/tpm/tpm.h +++ b/drivers/char/tpm/tpm.h @@ -164,8 +164,6 @@ extern const struct file_operations tpmrm_fops; extern struct idr dev_nums_idr; ssize_t tpm_transmit(struct tpm_chip *chip, u8 *buf, size_t bufsiz); -ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf, - size_t min_rsp_body_length, const char *desc); int tpm_get_timeouts(struct tpm_chip *); int tpm_auto_startup(struct tpm_chip *chip); @@ -194,8 +192,6 @@ static inline void tpm_msleep(unsigned int delay_msec) int tpm_chip_start(struct tpm_chip *chip); void tpm_chip_stop(struct tpm_chip *chip); struct tpm_chip *tpm_find_get_ops(struct tpm_chip *chip); -__must_check int tpm_try_get_ops(struct tpm_chip *chip); -void tpm_put_ops(struct tpm_chip *chip); struct tpm_chip *tpm_chip_alloc(struct device *dev, const struct tpm_class_ops *ops); diff --git a/include/linux/tpm.h b/include/linux/tpm.h index ae2482510f8c..543aa3b1dedc 100644 --- a/include/linux/tpm.h +++ b/include/linux/tpm.h @@ -404,6 +404,10 @@ static inline u32 tpm2_rc_value(u32 rc) #if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE) extern int tpm_is_tpm2(struct tpm_chip *chip); +extern __must_check int tpm_try_get_ops(struct tpm_chip *chip); +extern void tpm_put_ops(struct tpm_chip *chip); +extern ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf, + size_t min_rsp_body_length, const char *desc); extern int tpm_pcr_read(struct tpm_chip *chip, u32 pcr_idx, struct tpm_digest *digest); extern int tpm_pcr_extend(struct tpm_chip *chip, u32 pcr_idx, @@ -417,7 +421,6 @@ static inline int tpm_is_tpm2(struct tpm_chip *chip) { return -ENODEV; } - static inline int tpm_pcr_read(struct tpm_chip *chip, int pcr_idx, struct tpm_digest *digest) { diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c index 08ec7f48f01d..c87c4df8703d 100644 --- a/security/keys/trusted-keys/trusted_tpm2.c +++ b/security/keys/trusted-keys/trusted_tpm2.c @@ -79,10 +79,16 @@ int tpm2_seal_trusted(struct tpm_chip *chip, if (i == ARRAY_SIZE(tpm2_hash_map)) return -EINVAL; - rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE); + rc = tpm_try_get_ops(chip); if (rc) return rc; + rc = tpm_buf_init(&buf, TPM2_ST_SESSIONS, TPM2_CC_CREATE); + if (rc) { + tpm_put_ops(chip); + return rc; + } + tpm_buf_append_u32(&buf, options->keyhandle); tpm2_buf_append_auth(&buf, TPM2_RS_PW, NULL /* nonce */, 0, @@ -130,7 +136,7 @@ int tpm2_seal_trusted(struct tpm_chip *chip, goto out; } - rc = tpm_send(chip, buf.data, tpm_buf_length(&buf)); + rc = tpm_transmit_cmd(chip, &buf, 4, "sealing data"); if (rc) goto out; @@ -157,6 +163,7 @@ int tpm2_seal_trusted(struct tpm_chip *chip, rc = -EPERM; } + tpm_put_ops(chip); return rc; } @@ -211,7 +218,7 @@ static int tpm2_load_cmd(struct tpm_chip *chip, goto out; } - rc = tpm_send(chip, buf.data, tpm_buf_length(&buf)); + rc = tpm_transmit_cmd(chip, &buf, 4, "loading blob"); if (!rc) *blob_handle = be32_to_cpup( (__be32 *) &buf.data[TPM_HEADER_SIZE]); @@ -260,7 +267,7 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, options->blobauth /* hmac */, TPM_DIGEST_SIZE); - rc = tpm_send(chip, buf.data, tpm_buf_length(&buf)); + rc = tpm_transmit_cmd(chip, &buf, 6, "unsealing"); if (rc > 0) rc = -EPERM; @@ -304,12 +311,19 @@ int tpm2_unseal_trusted(struct tpm_chip *chip, u32 blob_handle; int rc; - rc = tpm2_load_cmd(chip, payload, options, &blob_handle); + rc = tpm_try_get_ops(chip); if (rc) return rc; + rc = tpm2_load_cmd(chip, payload, options, &blob_handle); + if (rc) + goto out; + rc = tpm2_unseal_cmd(chip, payload, options, blob_handle); tpm2_flush_context(chip, blob_handle); +out: + tpm_put_ops(chip); + return rc; }