[PATCH 1/2] tpm/tpm_ibmvtpm: Fail in ibmvtpm_get_data if driver_data is bad

[PATCH 1/2] tpm/tpm_ibmvtpm: Fail in ibmvtpm_get_data if driver_data is bad

[Anton Blanchard]

I'm looking at an oops in tpm_ibmvtpm_get_desired_dma:

  28:	00 00 20 39 	li      r9,0
  2c:	10 00 01 e8 	ld      r0,16(r1)
  30:	28 00 69 80 	lwz     r3,40(r9)

We set r9 to 0 then load r9+40. The problem is actually in
ibmvtpm_get_data, it can return NULL but the rest of the driver
never expects it.

Add a BUG_ON in ibmvtpm_get_data. We still need to identify the root
cause but at least this makes it obvious what went wrong.

Cc: stable@vger.kernel.org
Signed-off-by: Anton Blanchard <anton@samba.org>
---

diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index af74c57..0d1eeba 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -63,9 +63,9 @@ static int ibmvtpm_send_crq(struct vio_dev *vdev, u64 w1, u64 w2)
 static struct ibmvtpm_dev *ibmvtpm_get_data(const struct device *dev)
 {
 	struct tpm_chip *chip = dev_get_drvdata(dev);
-	if (chip)
-		return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
-	return NULL;
+
+	BUG_ON(!chip);
+	return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
 }
 
 /**

[PATCH 2/2] tpm/tpm_ibmvtpm: Remove unnecessary casts

[Anton Blanchard]

There is no need to cast from a void pointer to another pointer.

Signed-off-by: Anton Blanchard <anton@samba.org>
---

Index: b/drivers/char/tpm/tpm_ibmvtpm.c
===================================================================
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c
@@ -65,7 +65,7 @@ static struct ibmvtpm_dev *ibmvtpm_get_d
 	struct tpm_chip *chip = dev_get_drvdata(dev);
 
 	BUG_ON(!chip);
-	return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
+	return TPM_VPRIV(chip);
 }
 
 /**
@@ -83,7 +83,7 @@ static int tpm_ibmvtpm_recv(struct tpm_c
 	u16 len;
 	int sig;
 
-	ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
+	ibmvtpm = TPM_VPRIV(chip);
 
 	if (!ibmvtpm->rtce_buf) {
 		dev_err(ibmvtpm->dev, "ibmvtpm device is not ready\n");
@@ -127,7 +127,7 @@ static int tpm_ibmvtpm_send(struct tpm_c
 	u64 *word = (u64 *) &crq;
 	int rc;
 
-	ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
+	ibmvtpm = TPM_VPRIV(chip);
 
 	if (!ibmvtpm->rtce_buf) {
 		dev_err(ibmvtpm->dev, "ibmvtpm device is not ready\n");
@@ -521,7 +521,7 @@ static void ibmvtpm_crq_process(struct i
  **/
 static irqreturn_t ibmvtpm_interrupt(int irq, void *vtpm_instance)
 {
-	struct ibmvtpm_dev *ibmvtpm = (struct ibmvtpm_dev *) vtpm_instance;
+	struct ibmvtpm_dev *ibmvtpm = vtpm_instance;
 	struct ibmvtpm_crq *crq;
 
 	/* while loop is needed for initial setup (get version and

Re: [PATCH 1/2] tpm/tpm_ibmvtpm: Fail in ibmvtpm_get_data if driver_data is bad

[Ashley Lai]

Hi Anton,

Thanks for the patch.  Is this oops easy to recreate?  If so could 
you give us the steps to reproduce?

Thanks,
--Ashley Lai

On Sat, 20 Sep 2014, Anton Blanchard wrote:

> I'm looking at an oops in tpm_ibmvtpm_get_desired_dma:
>
>  28:	00 00 20 39 	li      r9,0
>  2c:	10 00 01 e8 	ld      r0,16(r1)
>  30:	28 00 69 80 	lwz     r3,40(r9)
>
> We set r9 to 0 then load r9+40. The problem is actually in
> ibmvtpm_get_data, it can return NULL but the rest of the driver
> never expects it.
>
> Add a BUG_ON in ibmvtpm_get_data. We still need to identify the root
> cause but at least this makes it obvious what went wrong.
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Anton Blanchard <anton@samba.org>
> ---
>
> diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
> index af74c57..0d1eeba 100644
> --- a/drivers/char/tpm/tpm_ibmvtpm.c
> +++ b/drivers/char/tpm/tpm_ibmvtpm.c
> @@ -63,9 +63,9 @@ static int ibmvtpm_send_crq(struct vio_dev *vdev, u64 w1, u64 w2)
> static struct ibmvtpm_dev *ibmvtpm_get_data(const struct device *dev)
> {
> 	struct tpm_chip *chip = dev_get_drvdata(dev);
> -	if (chip)
> -		return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
> -	return NULL;
> +
> +	BUG_ON(!chip);
> +	return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
> }
>
> /**
>

Re: [PATCH 1/2] tpm/tpm_ibmvtpm: Fail in ibmvtpm_get_data if driver_data is bad

[Ashley Lai]

On Sat, 20 Sep 2014, Anton Blanchard wrote:

> I'm looking at an oops in tpm_ibmvtpm_get_desired_dma:
>
>  28:	00 00 20 39 	li      r9,0
>  2c:	10 00 01 e8 	ld      r0,16(r1)
>  30:	28 00 69 80 	lwz     r3,40(r9)
>
> We set r9 to 0 then load r9+40. The problem is actually in
> ibmvtpm_get_data, it can return NULL but the rest of the driver
> never expects it.
>
> Add a BUG_ON in ibmvtpm_get_data. We still need to identify the root
> cause but at least this makes it obvious what went wrong.
>
> Cc: stable@vger.kernel.org
> Signed-off-by: Anton Blanchard <anton@samba.org>
> ---
>
> diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
> index af74c57..0d1eeba 100644
> --- a/drivers/char/tpm/tpm_ibmvtpm.c
> +++ b/drivers/char/tpm/tpm_ibmvtpm.c
> @@ -63,9 +63,9 @@ static int ibmvtpm_send_crq(struct vio_dev *vdev, u64 w1, u64 w2)
> static struct ibmvtpm_dev *ibmvtpm_get_data(const struct device *dev)
> {
> 	struct tpm_chip *chip = dev_get_drvdata(dev);
> -	if (chip)
> -		return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
> -	return NULL;
> +
> +	BUG_ON(!chip);
> +	return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
> }
>
> /**
>

Acked-by: Ashley Lai <ashley@ashleylai.com>

Re: [PATCH 2/2] tpm/tpm_ibmvtpm: Remove unnecessary casts

[Ashley Lai]

On Sat, 20 Sep 2014, Anton Blanchard wrote:

> There is no need to cast from a void pointer to another pointer.
>
> Signed-off-by: Anton Blanchard <anton@samba.org>

Acked-by: Ashley Lai <ashley@ashleylai.com>

Re: [tpmdd-devel] [PATCH 1/2] tpm/tpm_ibmvtpm: Fail in ibmvtpm_get_data if driver_data is bad

[Jason Gunthorpe]

On Mon, Sep 22, 2014 at 12:43:27PM -0500, Ashley Lai wrote:
> Hi Anton,
> 
> Thanks for the patch.  Is this oops easy to recreate?  If so could 
> you give us the steps to reproduce?

This looks like it is probably related to the uninitialization mess in
the TPM core (resource held during module unload?). A driver should
not have to defend itself against null drvdata, so the BUG makes
more sense than the if it is replacing.

Jason

Re: [tpmdd-devel] [PATCH 2/2] tpm/tpm_ibmvtpm: Remove unnecessary casts

[Jason Gunthorpe]

On Sat, Sep 20, 2014 at 07:30:14AM +1000, Anton Blanchard wrote:
> There is no need to cast from a void pointer to another pointer.

Looks reasonable to me:

Reviewed-By: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
 
> Signed-off-by: Anton Blanchard <anton@samba.org>
> 
> Index: b/drivers/char/tpm/tpm_ibmvtpm.c
> ===================================================================
> +++ b/drivers/char/tpm/tpm_ibmvtpm.c
> @@ -65,7 +65,7 @@ static struct ibmvtpm_dev *ibmvtpm_get_d
>  	struct tpm_chip *chip = dev_get_drvdata(dev);
>  
>  	BUG_ON(!chip);
> -	return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
> +	return TPM_VPRIV(chip);
>  }
>  
>  /**
> @@ -83,7 +83,7 @@ static int tpm_ibmvtpm_recv(struct tpm_c
>  	u16 len;
>  	int sig;
>  
> -	ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
> +	ibmvtpm = TPM_VPRIV(chip);
>  
>  	if (!ibmvtpm->rtce_buf) {
>  		dev_err(ibmvtpm->dev, "ibmvtpm device is not ready\n");
> @@ -127,7 +127,7 @@ static int tpm_ibmvtpm_send(struct tpm_c
>  	u64 *word = (u64 *) &crq;
>  	int rc;
>  
> -	ibmvtpm = (struct ibmvtpm_dev *)TPM_VPRIV(chip);
> +	ibmvtpm = TPM_VPRIV(chip);
>  
>  	if (!ibmvtpm->rtce_buf) {
>  		dev_err(ibmvtpm->dev, "ibmvtpm device is not ready\n");
> @@ -521,7 +521,7 @@ static void ibmvtpm_crq_process(struct i
>   **/
>  static irqreturn_t ibmvtpm_interrupt(int irq, void *vtpm_instance)
>  {
> -	struct ibmvtpm_dev *ibmvtpm = (struct ibmvtpm_dev *) vtpm_instance;
> +	struct ibmvtpm_dev *ibmvtpm = vtpm_instance;
>  	struct ibmvtpm_crq *crq;
>  
>  	/* while loop is needed for initial setup (get version and
> 
> Meet PCI DSS 3.0 Compliance Requirements with EventLog Analyzer
> Achieve PCI DSS 3.0 Compliant Status with Out-of-the-box PCI DSS Reports
> Are you Audit-Ready for PCI DSS 3.0 Compliance? Download White paper
> Comply to PCI DSS 3.0 Requirement 10 and 11.5 with EventLog Analyzer
> http://pubads.g.doubleclick.net/gampad/clk?id=154622311&iu=/4140/ostg.clktrk
> _______________________________________________
> tpmdd-devel mailing list
> tpmdd-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/tpmdd-devel

-- 
Jason Gunthorpe <jgunthorpe@obsidianresearch.com>        (780)4406067x832
Chief Technology Officer, Obsidian Research Corp         Edmonton, Canada

Re: [PATCH 1/2] tpm/tpm_ibmvtpm: Fail in ibmvtpm_get_data if driver_data is bad

[Ashley Lai]

> @@ -63,9 +63,9 @@ static int ibmvtpm_send_crq(struct vio_dev *vdev, u64 w1, u64 w2)
> static struct ibmvtpm_dev *ibmvtpm_get_data(const struct device *dev)
> {
> 	struct tpm_chip *chip = dev_get_drvdata(dev);
> -	if (chip)
> -		return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
> -	return NULL;
> +
> +	BUG_ON(!chip);

With the recent patch from Vicky, it is possible to have a NULL value for 
chip which will trigger a false positive for BUG_ON(!chip).

> +	return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
> }
>
> /**
>

Re: [PATCH 1/2] tpm/tpm_ibmvtpm: Fail in ibmvtpm_get_data if driver_data is bad

[Peter Hüwe]

Hi,

so shall I apply this patch? or not?

Thanks,
Peter

Am Dienstag, 2. Dezember 2014, 20:22:35 schrieb Ashley Lai:
> > @@ -63,9 +63,9 @@ static int ibmvtpm_send_crq(struct vio_dev *vdev, u64
> > w1, u64 w2) static struct ibmvtpm_dev *ibmvtpm_get_data(const struct
> > device *dev) {
> > 
> > 	struct tpm_chip *chip = dev_get_drvdata(dev);
> > 
> > -	if (chip)
> > -		return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
> > -	return NULL;
> > +
> > +	BUG_ON(!chip);
> 
> With the recent patch from Vicky, it is possible to have a NULL value for
> chip which will trigger a false positive for BUG_ON(!chip).
> 
> > +	return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
> > }
> > 
> > /**

Re: [PATCH 1/2] tpm/tpm_ibmvtpm: Fail in ibmvtpm_get_data if driver_data is bad

[Ashley Lai]

[-- Attachment #1: Type: TEXT/PLAIN, Size: 815 bytes --]

I recommend not applying this patch until we hear back from IBM.

Thanks,
--Ashley

On Tue, 2 Dec 2014, Peter Hüwe wrote:

> Hi,
>
> so shall I apply this patch? or not?
>
> Thanks,
> Peter
>
> Am Dienstag, 2. Dezember 2014, 20:22:35 schrieb Ashley Lai:
>>> @@ -63,9 +63,9 @@ static int ibmvtpm_send_crq(struct vio_dev *vdev, u64
>>> w1, u64 w2) static struct ibmvtpm_dev *ibmvtpm_get_data(const struct
>>> device *dev) {
>>>
>>> 	struct tpm_chip *chip = dev_get_drvdata(dev);
>>>
>>> -	if (chip)
>>> -		return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
>>> -	return NULL;
>>> +
>>> +	BUG_ON(!chip);
>>
>> With the recent patch from Vicky, it is possible to have a NULL value for
>> chip which will trigger a false positive for BUG_ON(!chip).
>>
>>> +	return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
>>> }
>>>
>>> /**
>
>

Re: [PATCH 1/2] tpm/tpm_ibmvtpm: Fail in ibmvtpm_get_data if driver_data is bad

[Peter Hüwe]

Hi Anton,

is this patchset still needed after Vicky's patch 
"[tpmdd-devel] Fix NULL return in tpm_ibmvtpm_get_desired_dma"
https://patchwork.ozlabs.org/patch/402315/

Ashley raised some concerns.

Since merge window is coming up, a fast reply is appreciated.


Thanks,
Peter

Am Freitag, 19. September 2014, 23:29:42 schrieb Anton Blanchard:
> I'm looking at an oops in tpm_ibmvtpm_get_desired_dma:
> 
>   28:	00 00 20 39 	li      r9,0
>   2c:	10 00 01 e8 	ld      r0,16(r1)
>   30:	28 00 69 80 	lwz     r3,40(r9)
> 
> We set r9 to 0 then load r9+40. The problem is actually in
> ibmvtpm_get_data, it can return NULL but the rest of the driver
> never expects it.
> 
> Add a BUG_ON in ibmvtpm_get_data. We still need to identify the root
> cause but at least this makes it obvious what went wrong.
> 
> Cc: stable@vger.kernel.org
> Signed-off-by: Anton Blanchard <anton@samba.org>
> ---
> 
> diff --git a/drivers/char/tpm/tpm_ibmvtpm.c
> b/drivers/char/tpm/tpm_ibmvtpm.c index af74c57..0d1eeba 100644
> --- a/drivers/char/tpm/tpm_ibmvtpm.c
> +++ b/drivers/char/tpm/tpm_ibmvtpm.c
> @@ -63,9 +63,9 @@ static int ibmvtpm_send_crq(struct vio_dev *vdev, u64 w1,
> u64 w2) static struct ibmvtpm_dev *ibmvtpm_get_data(const struct device
> *dev) {
>  	struct tpm_chip *chip = dev_get_drvdata(dev);
> -	if (chip)
> -		return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
> -	return NULL;
> +
> +	BUG_ON(!chip);
> +	return (struct ibmvtpm_dev *)TPM_VPRIV(chip);
>  }
> 
>  /**

Re: [PATCH 1/2] tpm/tpm_ibmvtpm: Fail in ibmvtpm_get_data if driver_data is bad

[Anton Blanchard]

Hi,

> is this patchset still needed after Vicky's patch 
> "[tpmdd-devel] Fix NULL return in tpm_ibmvtpm_get_desired_dma"
> https://patchwork.ozlabs.org/patch/402315/
> 
> Ashley raised some concerns.
> 
> Since merge window is coming up, a fast reply is appreciated.

We definitely need a way to catch an invalid driver data pointer, but it
looks like that needs to be reworked after Vicky's patch.

Vicky could you look at all uses of ibmvtpm_get_data and make
sure we don't blindly dereference it? eg:

static int tpm_ibmvtpm_resume(struct device *dev)
{
        struct ibmvtpm_dev *ibmvtpm = ibmvtpm_get_data(dev);
...

                rc = plpar_hcall_norets(H_ENABLE_CRQ,
                                        ibmvtpm->vdev->unit_address);

Anton

Re: [PATCH 1/2] tpm/tpm_ibmvtpm: Fail in ibmvtpm_get_data if driver_data is bad

[Hon Ching (Vicky) Lo]

Hi Anton,


vio_bus_probe now calls vio_cmo_bus_probe before calling probe.
This results in calling get_desired_dma to get rtce buf size 
before we have called probe which initializes vtpm driver and 
sets up the tpm data, i.e. rtce buf size.

ibmvtpm_get_data returns NULL in get_desired_dma is a special 
case where the device is not initialized.


Regards,
Vicky

On Wed, 2014-12-03 at 08:20 +1100, Anton Blanchard wrote:
> Hi,
> 
> > is this patchset still needed after Vicky's patch 
> > "[tpmdd-devel] Fix NULL return in tpm_ibmvtpm_get_desired_dma"
> > https://patchwork.ozlabs.org/patch/402315/
> > 
> > Ashley raised some concerns.
> > 
> > Since merge window is coming up, a fast reply is appreciated.
> 
> We definitely need a way to catch an invalid driver data pointer, but it
> looks like that needs to be reworked after Vicky's patch.
> 
> Vicky could you look at all uses of ibmvtpm_get_data and make
> sure we don't blindly dereference it? eg:
> 
> static int tpm_ibmvtpm_resume(struct device *dev)
> {
>         struct ibmvtpm_dev *ibmvtpm = ibmvtpm_get_data(dev);
> ...
> 
>                 rc = plpar_hcall_norets(H_ENABLE_CRQ,
>                                         ibmvtpm->vdev->unit_address);
> 
> Anton
>