linux-toradex.git/drivers/char/tpm/tpm.c, branch v3.0.8

TPM: Zero buffer after copying to userspace

2011-10-03T18:40:58+00:00

commit 3321c07ae5068568cd61ac9f4ba749006a7185c9 upstream.

Since the buffer might contain security related data it might be a good idea to
zero the buffer after we have copied it to userspace.

This got assigned CVE-2011-1162.

Signed-off-by: Rajiv Andrade 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

TPM: Call tpm_transmit with correct size

2011-10-03T18:40:58+00:00

commit 6b07d30aca7e52f2881b8c8c20c8a2cd28e8b3d3 upstream.

This patch changes the call of tpm_transmit by supplying the size of the
userspace buffer instead of TPM_BUFSIZE.

This got assigned CVE-2011-1161.

[The first hunk didn't make sense given one could expect
 way less data than TPM_BUFSIZE, so added tpm_transmit boundary
 check over bufsiz instead
 The last parameter of tpm_transmit() reflects the amount
 of data expected from the device, and not the buffer size
 being supplied to it. It isn't ideal to parse it directly,
 so we just set it to the maximum the input buffer can handle
 and let the userspace API to do such job.]

Signed-off-by: Rajiv Andrade 
Signed-off-by: James Morris 
Signed-off-by: Greg Kroah-Hartman

char/tpm: Fix unitialized usage of data buffer

2011-03-29T16:45:34+00:00

This patch fixes information leakage to the userspace by initializing
the data buffer to zero.

Reported-by: Peter Huewe 
Signed-off-by: Peter Huewe 
Signed-off-by: Marcel Selhorst 
[ Also removed the silly "* sizeof(u8)".  If that isn't 1, we have way
  deeper problems than a simple multiplication can fix.   - Linus ]
Signed-off-by: Linus Torvalds

Revert "TPM: Long default timeout fix"

2011-03-01T21:23:27+00:00

This reverts commit c4ff4b829ef9e6353c0b133b7adb564a68054979.

Ted Ts'o reports:

 "TPM is working for me so I can log into employer's network in 2.6.37.
  It broke when I tried 2.6.38-rc6, with the following relevant lines
  from my dmesg:

  [   11.081627] tpm_tis 00:0b: 1.2 TPM (device-id 0x0, rev-id 78)
  [   25.734114] tpm_tis 00:0b: Operation Timed out
  [   78.040949] tpm_tis 00:0b: Operation Timed out

  This caused me to get suspicious, especially since the _other_ TPM
  commit in 2.6.38 had already been reverted, so I tried reverting
  commit c4ff4b829e: "TPM: Long default timeout fix".  With this commit
  reverted, my TPM on my Lenovo T410 is once again working."

Requested-and-tested-by: Theodore Ts'o 
Acked-by: Rajiv Andrade 
Signed-off-by: Linus Torvalds

Revert "tpm_tis: Use timeouts returned from TPM"

2011-02-20T18:03:12+00:00

This reverts commit 9b29050f8f75916f974a2d231ae5d3cd59792296.

It has caused hibernate regressions, for example Juri Sladby's report:

  "I'm unable to hibernate 2.6.37.1 unless I rmmod tpm_tis:
   [10974.074587] Suspending console(s) (use no_console_suspend to debug)
   [10974.103073] tpm_tis 00:0c: Operation Timed out
   [10974.103089] legacy_suspend(): pnp_bus_suspend+0x0/0xa0 returns -62
   [10974.103095] PM: Device 00:0c failed to freeze: error -62"

and Rafael points out that some of the new conditionals in that commit
seem to make no sense.  This commit needs more work and testing, let's
revert it for now.

Reported-by: Norbert Preining 
Reported-and-requested-by: Jiri Slaby 
Cc: Stefan Berger 
Cc: Guillaume Chazarain 
Cc: Rajiv Andrade 
Acked-by: Rafael J. Wysocki 
Signed-off-by: Linus Torvalds

tpm_tis: Use timeouts returned from TPM

2011-02-11T03:30:50+00:00

The current TPM TIS driver in git discards the timeout values returned
from the TPM. The check of the response packet needs to consider that
the return_code field is 0 on success and the size of the expected
packet is equivalent to the header size + u32 length indicator for the
TPM_GetCapability() result + 3 timeout indicators of type u32.

I am also adding a sysfs entry 'timeouts' showing the timeouts that are
being used.

Signed-off-by: Stefan Berger 
Tested-by: Guillaume Chazarain 
Signed-off-by: Rajiv Andrade

TPM: Long default timeout fix

2011-01-24T00:22:48+00:00

If duration variable value is 0 at this point, it's because
chip->vendor.duration wasn't filled by tpm_get_timeouts() yet.
This patch sets then the lowest timeout just to give enough
time for tpm_get_timeouts() to further succeed.

This fix avoids long boot times in case another entity attempts
to send commands to the TPM when the TPM isn't accessible.

Signed-off-by: Rajiv Andrade 
Signed-off-by: James Morris

Merge branch 'master' into next

2011-01-09T22:46:24+00:00

Conflicts:
	security/smack/smack_lsm.c

Verified and added fix by Stephen Rothwell 
Ok'd by Casey Schaufler 

Signed-off-by: James Morris

tpm: don't use flush_scheduled_work()

2010-12-24T14:59:07+00:00

flush_scheduled_work() is deprecated and scheduled to be removed.
Directly flush chip->work instead.

Signed-off-by: Tejun Heo 
Cc: Debora Velarde 
Cc: Rajiv Andrade

key: add tpm_send command

2010-11-28T21:55:22+00:00

Add internal kernel tpm_send() command used to seal/unseal keys.

Changelog:
- replaced module_put in tpm_send() with new tpm_chip_put() wrapper
  (suggested by David Howells)
- Make tpm_send() cmd argument a 'void *' (suggested by David Howells)

Signed-off-by: David Safford 
Signed-off-by: Mimi Zohar 
Acked-by: David Howells 
Acked-by: Serge E. Hallyn 
Signed-off-by: James Morris