linux-toradex.git/drivers/char/tpm, branch v3.2.68

tpm: Provide a generic means to override the chip returned timeouts

2014-09-13T22:41:40+00:00

commit 8e54caf407b98efa05409e1fee0e5381abd2b088 upstream.

Some Atmel TPMs provide completely wrong timeouts from their
TPM_CAP_PROP_TIS_TIMEOUT query. This patch detects that and returns
new correct values via a DID/VID table in the TIS driver.

Tested on ARM using an AT97SC3204T FW version 37.16

[PHuewe: without this fix these 'broken' Atmel TPMs won't function on
older kernels]
Signed-off-by: "Berg, Christopher" 
Signed-off-by: Jason Gunthorpe 

Signed-off-by: Peter Huewe 
[bwh: Backported to 3.2:
 - Adjust filename, context
 - s/chip->ops->/chip->vendor./]
Signed-off-by: Ben Hutchings

tpm: Propagate error from tpm_transmit to fix a timeout hang

2012-10-30T23:27:09+00:00

commit abce9ac292e13da367bbd22c1f7669f988d931ac upstream.

tpm_write calls tpm_transmit without checking the return value and
assigns the return value unconditionally to chip->pending_data, even if
it's an error value.
This causes three bugs.

So if we write to /dev/tpm0 with a tpm_param_size bigger than
TPM_BUFSIZE=0x1000 (e.g. 0x100a)
and a bufsize also bigger than TPM_BUFSIZE (e.g. 0x100a)
tpm_transmit returns -E2BIG which is assigned to chip->pending_data as
-7, but tpm_write returns that TPM_BUFSIZE bytes have been successfully
been written to the TPM, altough this is not true (bug #1).

As we did write more than than TPM_BUFSIZE bytes but tpm_write reports
that only TPM_BUFSIZE bytes have been written the vfs tries to write
the remaining bytes (in this case 10 bytes) to the tpm device driver via
tpm_write which then blocks at

 /* cannot perform a write until the read has cleared
 either via tpm_read or a user_read_timer timeout */
 while (atomic_read(&chip->data_pending) != 0)
	 msleep(TPM_TIMEOUT);

for 60 seconds, since data_pending is -7 and nobody is able to
read it (since tpm_read luckily checks if data_pending is greater than
0) (#bug 2).

After that the remaining bytes are written to the TPM which are
interpreted by the tpm as a normal command. (bug #3)
So if the last bytes of the command stream happen to be a e.g.
tpm_force_clear this gets accidentally sent to the TPM.

This patch fixes all three bugs, by propagating the error code of
tpm_write and returning -E2BIG if the input buffer is too big,
since the response from the tpm for a truncated value is bogus anyway.
Moreover it returns -EBUSY to userspace if there is a response ready to be
read.

Signed-off-by: Peter Huewe 
Signed-off-by: Kent Yoder 
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Ben Hutchings

TPM: Zero buffer whole after copying to userspace

2012-04-02T16:52:37+00:00

commit 3ab1aff89477dafb1aaeafe8c8669114a02b7226 upstream.

Commit 3321c07ae5068568cd61ac9f4ba749006a7185c9 correctly clears the TPM
buffer if the user specified read length is >= the TPM buffer length. However,
if the user specified read length is < the TPM buffer length, then part of the
TPM buffer is left uncleared.

Reported-by: Seth Forshee 
Cc: Debora Velarde 
Cc: Rajiv Andrade 
Cc: Marcel Selhorst 
Cc: tpmdd-devel@lists.sourceforge.net
Signed-off-by: Tim Gardner 
Signed-off-by: Rajiv Andrade 
Signed-off-by: Greg Kroah-Hartman

ima: fix Kconfig dependencies

2012-04-02T16:52:36+00:00

commit f4a0391dfa91155bd961673b31eb42d9d45c799d upstream.

Fix the following build warning:
warning: (IMA) selects TCG_TPM which has unmet direct dependencies
(HAS_IOMEM && EXPERIMENTAL)

Suggested-by: Rajiv Andrade 
Signed-off-by: Fabio Estevam 
Signed-off-by: Rajiv Andrade 
Signed-off-by: Mimi Zohar 
Signed-off-by: Greg Kroah-Hartman

tpm_tis: add delay after aborting command

2012-02-03T17:21:35+00:00

commit a927b8131794ee449b7f6666e7ab61301949b20f upstream.

This patch adds a delay after aborting a command. Some TPMs need
this and will not process the subsequent command correctly otherwise.

It's worth noting that a TPM randomly failing to process a command,
maps to randomly failing suspend/resume operations.

Signed-off-by: Stefan Berger 
Signed-off-by: Rajiv Andrade 
Signed-off-by: Greg Kroah-Hartman

Merge branch 'next' of git://selinuxproject.org/~jmorris/linux-security

2011-10-25T07:45:31+00:00

* 'next' of git://selinuxproject.org/~jmorris/linux-security: (95 commits)
  TOMOYO: Fix incomplete read after seek.
  Smack: allow to access /smack/access as normal user
  TOMOYO: Fix unused kernel config option.
  Smack: fix: invalid length set for the result of /smack/access
  Smack: compilation fix
  Smack: fix for /smack/access output, use string instead of byte
  Smack: domain transition protections (v3)
  Smack: Provide information for UDS getsockopt(SO_PEERCRED)
  Smack: Clean up comments
  Smack: Repair processing of fcntl
  Smack: Rule list lookup performance
  Smack: check permissions from user space (v2)
  TOMOYO: Fix quota and garbage collector.
  TOMOYO: Remove redundant tasklist_lock.
  TOMOYO: Fix domain transition failure warning.
  TOMOYO: Remove tomoyo_policy_memory_lock spinlock.
  TOMOYO: Simplify garbage collector.
  TOMOYO: Fix make namespacecheck warnings.
  target: check hex2bin result
  encrypted-keys: check hex2bin result
  ...

TPM: Zero buffer after copying to userspace

2011-09-22T23:46:41+00:00

Since the buffer might contain security related data it might be a good idea to
zero the buffer after we have copied it to userspace.

This got assigned CVE-2011-1162.

Signed-off-by: Rajiv Andrade 
Cc: Stable Kernel 
Signed-off-by: James Morris

TPM: Call tpm_transmit with correct size

2011-09-22T23:46:29+00:00

This patch changes the call of tpm_transmit by supplying the size of the
userspace buffer instead of TPM_BUFSIZE.

This got assigned CVE-2011-1161.

[The first hunk didn't make sense given one could expect
 way less data than TPM_BUFSIZE, so added tpm_transmit boundary
 check over bufsiz instead
 The last parameter of tpm_transmit() reflects the amount
 of data expected from the device, and not the buffer size
 being supplied to it. It isn't ideal to parse it directly,
 so we just set it to the maximum the input buffer can handle
 and let the userspace API to do such job.]

Signed-off-by: Rajiv Andrade 
Cc: Stable Kernel 
Signed-off-by: James Morris

TPM: tpm_nsc: Fix a double free of pdev in cleanup_nsc

2011-09-22T23:46:17+00:00

platform_device_unregister() will release all resources
and remove it from the subsystem, then drop reference count by
calling platform_device_put().

We should not call kfree(pdev) after platform_device_unregister(pdev).

Signed-off-by: Axel Lin 
Signed-off-by: Rajiv Andrade 
Signed-off-by: James Morris

TPM: TCG_ATMEL should depend on HAS_IOPORT

2011-09-22T23:45:57+00:00

On m68k, I get:

drivers/char/tpm/tpm_atmel.h: In function ‘atmel_get_base_addr’:
drivers/char/tpm/tpm_atmel.h:129: error: implicit declaration of function ‘ioport_map’
drivers/char/tpm/tpm_atmel.h:129: warning: return makes pointer from integer without a cast

The code in tpm_atmel.h supports PPC64 (using the device tree and ioremap())
and "anything else" (using ioport_map()). However, ioportmap() is only
available on platforms that set HAS_IOPORT.

Although PC64 seems to have HAS_IOPORT, a "depends on HAS_IOPORT" should work,
but I think it's better to expose the special PPC64 handling explicit using
"depends on PPC64 || HAS_IOPORT".

Signed-off-by: Geert Uytterhoeven 
Signed-off-by: Rajiv Andrade 
Signed-off-by: James Morris