[PATCH v11 14/20] tpm: Protect against locality counter underflow

0 views

Skip to first unread message

Ross Philipson

unread,

Sep 13, 2024, 4:12:41 PM9/13/24

to linux-...@vger.kernel.org, x...@kernel.org, linux-i...@vger.kernel.org, linu...@vger.kernel.org, linux-...@vger.kernel.org, ke...@lists.infradead.org, linu...@vger.kernel.org, io...@lists.linux-foundation.org, ross.ph...@oracle.com, dps...@apertussolutions.com, tg...@linutronix.de, mi...@redhat.com, b...@alien8.de, h...@zytor.com, dave....@linux.intel.com, ar...@kernel.org, mj...@srcf.ucam.org, James.B...@hansenpartnership.com, peter...@gmx.de, jar...@kernel.org, j...@ziepe.ca, lu...@amacapital.net, nive...@alum.mit.edu, her...@gondor.apana.org.au, da...@davemloft.net, cor...@lwn.net, ebie...@xmission.com, dw...@infradead.org, baol...@linux.intel.com, kanth.g...@oracle.com, andrew....@citrix.com, trenchbo...@googlegroups.com

From: "Daniel P. Smith" <dps...@apertussolutions.com>

Commit 933bfc5ad213 introduced the use of a locality counter to control when a
locality request is allowed to be sent to the TPM. In the commit, the counter
is indiscriminately decremented. Thus creating a situation for an integer
underflow of the counter.

Signed-off-by: Daniel P. Smith <dps...@apertussolutions.com>
Signed-off-by: Ross Philipson <ross.ph...@oracle.com>
Reported-by: Kanth Ghatraju <kanth.g...@oracle.com>
---
drivers/char/tpm/tpm_tis_core.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
index fdef214b9f6b..a6967f312837 100644
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -180,7 +180,10 @@ static int tpm_tis_relinquish_locality(struct tpm_chip *chip, int l)
struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);

mutex_lock(&priv->locality_count_mutex);
- priv->locality_count--;
+ if (priv->locality_count > 0)
+ priv->locality_count--;
+ else
+ pr_info("Invalid: locality count dropped below zero\n");
if (priv->locality_count == 0)
__tpm_tis_relinquish_locality(priv, l);
mutex_unlock(&priv->locality_count_mutex);
--
2.39.3

Jarkko Sakkinen

unread,

Nov 1, 2024, 9:56:19 AM11/1/24

to Ross Philipson, linux-...@vger.kernel.org, x...@kernel.org, linux-i...@vger.kernel.org, linu...@vger.kernel.org, linux-...@vger.kernel.org, ke...@lists.infradead.org, linu...@vger.kernel.org, io...@lists.linux-foundation.org, dps...@apertussolutions.com, tg...@linutronix.de, mi...@redhat.com, b...@alien8.de, h...@zytor.com, dave....@linux.intel.com, ar...@kernel.org, mj...@srcf.ucam.org, James.B...@hansenpartnership.com, peter...@gmx.de, j...@ziepe.ca, lu...@amacapital.net, nive...@alum.mit.edu, her...@gondor.apana.org.au, da...@davemloft.net, cor...@lwn.net, ebie...@xmission.com, dw...@infradead.org, baol...@linux.intel.com, kanth.g...@oracle.com, andrew....@citrix.com, trenchbo...@googlegroups.com

On Fri Sep 13, 2024 at 11:05 PM EEST, Ross Philipson wrote:
> From: "Daniel P. Smith" <dps...@apertussolutions.com>
>
> Commit 933bfc5ad213 introduced the use of a locality counter to control when a
> locality request is allowed to be sent to the TPM. In the commit, the counter
> is indiscriminately decremented. Thus creating a situation for an integer
> underflow of the counter.
>
> Signed-off-by: Daniel P. Smith <dps...@apertussolutions.com>
> Signed-off-by: Ross Philipson <ross.ph...@oracle.com>
> Reported-by: Kanth Ghatraju <kanth.g...@oracle.com>

Remove reported-by.

> ---
> drivers/char/tpm/tpm_tis_core.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
> index fdef214b9f6b..a6967f312837 100644
> --- a/drivers/char/tpm/tpm_tis_core.c
> +++ b/drivers/char/tpm/tpm_tis_core.c
> @@ -180,7 +180,10 @@ static int tpm_tis_relinquish_locality(struct tpm_chip *chip, int l)
> struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
>
> mutex_lock(&priv->locality_count_mutex);
> - priv->locality_count--;
> + if (priv->locality_count > 0)
> + priv->locality_count--;
> + else
> + pr_info("Invalid: locality count dropped below zero\n");

Explain the context.

> if (priv->locality_count == 0)
> __tpm_tis_relinquish_locality(priv, l);
> mutex_unlock(&priv->locality_count_mutex);