[PATCH] tpm: Check non-nullity of chip->auth

[PATCH] tpm: Check non-nullity of chip->auth

[Jarkko Sakkinen]

All exported functions lack the check for non-nullity of chip->auth. Add
the guard for each.

Link: https://lore.kernel.org/linux-integrity/9f86a167074d9b522311715c567f1c19b88e3ad4.camel@kernel.org/
Cc: Stefan Berger <stefanb@linux.ibm.com>
Cc: stable@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Fixes: 1085b8276bb4 ("tpm: Add the rest of the session HMAC API")
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
---
 drivers/char/tpm/tpm2-sessions.c | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c
index 907ac9956a78..d833db20531a 100644
--- a/drivers/char/tpm/tpm2-sessions.c
+++ b/drivers/char/tpm/tpm2-sessions.c
@@ -377,6 +377,9 @@ void tpm_buf_append_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf,
 	u32 len;
 	struct tpm2_auth *auth = chip->auth;
 
+	if (!auth)
+		return;
+
 	/*
 	 * The Architecture Guide requires us to strip trailing zeros
 	 * before computing the HMAC
@@ -449,6 +452,9 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf)
 	u8 cphash[SHA256_DIGEST_SIZE];
 	struct sha256_state sctx;
 
+	if (!auth)
+		return;
+
 	/* save the command code in BE format */
 	auth->ordinal = head->ordinal;
 
@@ -639,6 +645,9 @@ void tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf,
 	struct tpm2_auth *auth = chip->auth;
 	int slot;
 
+	if (!auth)
+		return;
+
 	slot = (tpm_buf_length(buf) - TPM_HEADER_SIZE)/4;
 	if (slot >= AUTH_MAX_NAMES) {
 		dev_err(&chip->dev, "TPM: too many handles\n");
@@ -705,6 +714,9 @@ int tpm_buf_check_hmac_response(struct tpm_chip *chip, struct tpm_buf *buf,
 	u32 cc = be32_to_cpu(auth->ordinal);
 	int parm_len, len, i, handles;
 
+	if (!auth)
+		return rc;
+
 	if (auth->session >= TPM_HEADER_SIZE) {
 		WARN(1, "tpm session not filled correctly\n");
 		goto out;
@@ -824,8 +836,13 @@ EXPORT_SYMBOL(tpm_buf_check_hmac_response);
  */
 void tpm2_end_auth_session(struct tpm_chip *chip)
 {
-	tpm2_flush_context(chip, chip->auth->handle);
-	memzero_explicit(chip->auth, sizeof(*chip->auth));
+	struct tpm2_auth *auth = chip->auth;
+
+	if (!auth)
+		return;
+
+	tpm2_flush_context(chip, auth->handle);
+	memzero_explicit(auth, sizeof(*auth));
 }
 EXPORT_SYMBOL(tpm2_end_auth_session);
 
@@ -907,6 +924,11 @@ int tpm2_start_auth_session(struct tpm_chip *chip)
 	int rc;
 	u32 null_key;
 
+	if (!auth) {
+		pr_warn_once("%s: encryption is not active\n", __func__);
+		return 0;
+	}
+
 	rc = tpm2_load_null(chip, &null_key);
 	if (rc)
 		goto out;
-- 
2.45.2

Re: [PATCH] tpm: Check non-nullity of chip->auth

[Stefan Berger]

On 7/1/24 13:07, Jarkko Sakkinen wrote:
> All exported functions lack the check for non-nullity of chip->auth. Add
> the guard for each.
> 
> Link: https://lore.kernel.org/linux-integrity/9f86a167074d9b522311715c567f1c19b88e3ad4.camel@kernel.org/
> Cc: Stefan Berger <stefanb@linux.ibm.com>
> Cc: stable@vger.kernel.org
> Cc: linux-kernel@vger.kernel.org
> Fixes: 1085b8276bb4 ("tpm: Add the rest of the session HMAC API")
> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> ---
>   drivers/char/tpm/tpm2-sessions.c | 26 ++++++++++++++++++++++++--
>   1 file changed, 24 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c
> index 907ac9956a78..d833db20531a 100644
> --- a/drivers/char/tpm/tpm2-sessions.c
> +++ b/drivers/char/tpm/tpm2-sessions.c
> @@ -377,6 +377,9 @@ void tpm_buf_append_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf,
>   	u32 len;
>   	struct tpm2_auth *auth = chip->auth;
>   
> +	if (!auth)
> +		return;
> +
>   	/*
>   	 * The Architecture Guide requires us to strip trailing zeros
>   	 * before computing the HMAC
> @@ -449,6 +452,9 @@ void tpm_buf_fill_hmac_session(struct tpm_chip *chip, struct tpm_buf *buf)
>   	u8 cphash[SHA256_DIGEST_SIZE];
>   	struct sha256_state sctx;
>   
> +	if (!auth)
> +		return;
> +
>   	/* save the command code in BE format */
>   	auth->ordinal = head->ordinal;
>   
> @@ -639,6 +645,9 @@ void tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf,
>   	struct tpm2_auth *auth = chip->auth;
>   	int slot;
>   
> +	if (!auth)
> +		return;
> +
>   	slot = (tpm_buf_length(buf) - TPM_HEADER_SIZE)/4;
>   	if (slot >= AUTH_MAX_NAMES) {
>   		dev_err(&chip->dev, "TPM: too many handles\n");
> @@ -705,6 +714,9 @@ int tpm_buf_check_hmac_response(struct tpm_chip *chip, struct tpm_buf *buf,
>   	u32 cc = be32_to_cpu(auth->ordinal);
>   	int parm_len, len, i, handles;
>   
> +	if (!auth)
> +		return rc;
> +
>   	if (auth->session >= TPM_HEADER_SIZE) {
>   		WARN(1, "tpm session not filled correctly\n");
>   		goto out;
> @@ -824,8 +836,13 @@ EXPORT_SYMBOL(tpm_buf_check_hmac_response);
>    */
>   void tpm2_end_auth_session(struct tpm_chip *chip)
>   {
> -	tpm2_flush_context(chip, chip->auth->handle);
> -	memzero_explicit(chip->auth, sizeof(*chip->auth));
> +	struct tpm2_auth *auth = chip->auth;
> +
> +	if (!auth)
> +		return;
> +
> +	tpm2_flush_context(chip, auth->handle);
> +	memzero_explicit(auth, sizeof(*auth));
>   }
>   EXPORT_SYMBOL(tpm2_end_auth_session);
>   
> @@ -907,6 +924,11 @@ int tpm2_start_auth_session(struct tpm_chip *chip)
>   	int rc;
>   	u32 null_key;
>   
> +	if (!auth) {
> +		pr_warn_once("%s: encryption is not active\n", __func__);
> +		return 0;
> +	}
> +
>   	rc = tpm2_load_null(chip, &null_key);
>   	if (rc)
>   		goto out;
It looks like you got all of the chip->auth tested:

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>

As I mentioned in the other email (1), it does not solve the problem on 
ppc64.

1: 
https://lore.kernel.org/linux-integrity/656b319fc58683e399323b880722434467cf20f2.camel@kernel.org/T/#m88892cb6f9cf8fdef875dcdd0ed3eccac1d28190