From nobody Wed Oct 1 23:30:06 2025 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DE5DF217F31; Mon, 29 Sep 2025 04:00:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1759118426; cv=none; b=tvVmJMJ2T18rWUaWLpK3YzC1qmJqlB+SRj4pnKc3a/c6RqcV+ULBPN66P4o3031Fcqt6bwvX01qDiqF2Re61z672U2oMrdzuFG8eHQUG+DqMV1Sw5qTs+O3vHPDIcPeiCSIXFTUSoOg3D8h3y04Hs3by8WHEdNa+GC2x2Eq+vMk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1759118426; c=relaxed/simple; bh=94I9UMCMobtGGBP9Hdzd2RpPRLWl5wNSt5LPS8OBLh8=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=oIASzzUn6z+aTpXnIz6SEwyB1JobqRqkNV3F9X6jxEHPwWFs3MSsNQWnqLE2f0FLnL6r8vkw1yOc8UrEiwn3Arg/+UASEbQ/JmDGro6+LAbgO5oE1j7zEuHxyPloKMVFnBOUTU8PORdOnlNlmQvONcV1rGsUH+XtAGuFH2L7/Mo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=TzSWYtWD; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="TzSWYtWD" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E9921C116B1; Mon, 29 Sep 2025 04:00:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1759118425; bh=94I9UMCMobtGGBP9Hdzd2RpPRLWl5wNSt5LPS8OBLh8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TzSWYtWDNZZxZve67AbASK0O1L30lqoigxBx+NbmJoy9M7ienicCCrySwY5G8jSMI aEAmh4Z+BgWt66nVMW/0+CJT7Xzs750UjwI9QpOEGjW1pPkdsP2Ro49hRfD0UkwPU0 HpDkigUqoU21w8MjLwmrUbLvYyk2I/J0nzl14OpuqYDrtaH//lcyErfJZdRP+B/0wK XH9uujZFzblYmKFFMFt3dtAMvDw7pdlDzWEqZAbfPLC13okOuxX3Vkipv3pbJdCCL6 fBEjsQSL6r3aqGz04YP/BiXpoSKbdQzOx7CFEqW5iLEfCb1OWlTI7RFO5PeNB4rfqd 6ehQ4uE7s1zdQ== From: Jarkko Sakkinen To: linux-integrity@vger.kernel.org Cc: dpsmith@apertussolutions.com, ross.philipson@oracle.com, Jarkko Sakkinen , Peter Huewe , Jarkko Sakkinen , Jason Gunthorpe , David Howells , Paul Moore , James Morris , "Serge E. Hallyn" , James Bottomley , Mimi Zohar , linux-kernel@vger.kernel.org (open list), keyrings@vger.kernel.org (open list:KEYS/KEYRINGS), linux-security-module@vger.kernel.org (open list:SECURITY SUBSYSTEM) Subject: [PATCH v2 7/9] tpm-buf: check for corruption in tpm_buf_append_handle() Date: Mon, 29 Sep 2025 06:59:36 +0300 Message-Id: <20250929035938.1773341-8-jarkko@kernel.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250929035938.1773341-1-jarkko@kernel.org> References: <20250929035938.1773341-1-jarkko@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Jarkko Sakkinen Unify TPM_BUF_BOUNDARY_ERROR and TPM_BUF_OVERFLOW into TPM_BUF_INVALID flag because semantically they are identical. Test and set TPM_BUF_INVALID in tpm_buf_append_handle() following the pattern from other functions in tpm-buf.c. Signed-off-by: Jarkko Sakkinen --- v2: - A new patch. --- drivers/char/tpm/tpm-buf.c | 14 ++++++++------ include/linux/tpm.h | 8 +++----- security/keys/trusted-keys/trusted_tpm2.c | 6 +++--- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/drivers/char/tpm/tpm-buf.c b/drivers/char/tpm/tpm-buf.c index dc882fc9fa9e..5526f548b4de 100644 --- a/drivers/char/tpm/tpm-buf.c +++ b/drivers/char/tpm/tpm-buf.c @@ -104,13 +104,12 @@ EXPORT_SYMBOL_GPL(tpm_buf_length); */ void tpm_buf_append(struct tpm_buf *buf, const u8 *new_data, u16 new_lengt= h) { - /* Return silently if overflow has already happened. */ - if (buf->flags & TPM_BUF_OVERFLOW) + if (buf->flags & TPM_BUF_INVALID) return; =20 if ((buf->length + new_length) > PAGE_SIZE) { WARN(1, "tpm_buf: write overflow\n"); - buf->flags |=3D TPM_BUF_OVERFLOW; + buf->flags |=3D TPM_BUF_INVALID; return; } =20 @@ -157,7 +156,11 @@ EXPORT_SYMBOL_GPL(tpm_buf_append_u32); */ void tpm_buf_append_handle(struct tpm_chip *chip, struct tpm_buf *buf, u32= handle) { + if (buf->flags & TPM_BUF_INVALID) + return; + if (buf->flags & TPM_BUF_TPM2B) { + buf->flags |=3D TPM_BUF_INVALID; dev_err(&chip->dev, "Invalid buffer type (TPM2B)\n"); return; } @@ -177,14 +180,13 @@ static void tpm_buf_read(struct tpm_buf *buf, off_t *= offset, size_t count, void { off_t next_offset; =20 - /* Return silently if overflow has already happened. */ - if (buf->flags & TPM_BUF_BOUNDARY_ERROR) + if (buf->flags & TPM_BUF_INVALID) return; =20 next_offset =3D *offset + count; if (next_offset > buf->length) { WARN(1, "tpm_buf: read out of boundary\n"); - buf->flags |=3D TPM_BUF_BOUNDARY_ERROR; + buf->flags |=3D TPM_BUF_INVALID; return; } =20 diff --git a/include/linux/tpm.h b/include/linux/tpm.h index e72e7657faa2..5283f32781c4 100644 --- a/include/linux/tpm.h +++ b/include/linux/tpm.h @@ -366,12 +366,10 @@ struct tpm_header { } __packed; =20 enum tpm_buf_flags { - /* the capacity exceeded: */ - TPM_BUF_OVERFLOW =3D BIT(0), /* TPM2B format: */ - TPM_BUF_TPM2B =3D BIT(1), - /* read out of boundary: */ - TPM_BUF_BOUNDARY_ERROR =3D BIT(2), + TPM_BUF_TPM2B =3D BIT(0), + /* The buffer is in invalid and unusable state: */ + TPM_BUF_INVALID =3D BIT(1), }; =20 /* diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trus= ted-keys/trusted_tpm2.c index 8e3b283a59b2..119d5152c0db 100644 --- a/security/keys/trusted-keys/trusted_tpm2.c +++ b/security/keys/trusted-keys/trusted_tpm2.c @@ -295,7 +295,7 @@ int tpm2_seal_trusted(struct tpm_chip *chip, /* creation PCR */ tpm_buf_append_u32(&buf, 0); =20 - if (buf.flags & TPM_BUF_OVERFLOW) { + if (buf.flags & TPM_BUF_INVALID) { rc =3D -E2BIG; tpm2_end_auth_session(chip); goto out; @@ -308,7 +308,7 @@ int tpm2_seal_trusted(struct tpm_chip *chip, goto out; =20 blob_len =3D tpm_buf_read_u32(&buf, &offset); - if (blob_len > MAX_BLOB_SIZE || buf.flags & TPM_BUF_BOUNDARY_ERROR) { + if (blob_len > MAX_BLOB_SIZE || buf.flags & TPM_BUF_INVALID) { rc =3D -E2BIG; goto out; } @@ -414,7 +414,7 @@ static int tpm2_load_cmd(struct tpm_chip *chip, =20 tpm_buf_append(&buf, blob, blob_len); =20 - if (buf.flags & TPM_BUF_OVERFLOW) { + if (buf.flags & TPM_BUF_INVALID) { rc =3D -E2BIG; tpm2_end_auth_session(chip); goto out; --=20 2.39.5