[PATCH] tpm: Fix tpm_send() length calculation

[PATCH] tpm: Fix tpm_send() length calculation

[Jarkko Sakkinen]

Set the size of the tpm_buf correctly. Now it is set to the header
length by tpm_buf_init().

Reported-by: Mimi Zohar <zohar@linux.ibm.com>
Cc: stable@vger.kernel.org
Fixes: 412eb585587a ("use tpm_buf in tpm_transmit_cmd() as the IO parameter")
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
---
 drivers/char/tpm/tpm-interface.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index d9ace5480665..4aa7e7f91139 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -363,6 +363,8 @@ int tpm_send(struct tpm_chip *chip, void *cmd, size_t buflen)
 		goto out;
 
 	memcpy(buf.data, cmd, buflen);
+	buf.length = buflen;
+
 	rc = tpm_transmit_cmd(chip, &buf, 0, "attempting to a send a command");
 	tpm_buf_destroy(&buf);
 out:
-- 
2.20.1

Re: [PATCH] tpm: Fix tpm_send() length calculation

[Jarkko Sakkinen]

On Mon, Sep 16, 2019 at 10:35:35AM +0300, Jarkko Sakkinen wrote:
> Set the size of the tpm_buf correctly. Now it is set to the header
> length by tpm_buf_init().
> 
> Reported-by: Mimi Zohar <zohar@linux.ibm.com>
> Cc: stable@vger.kernel.org
> Fixes: 412eb585587a ("use tpm_buf in tpm_transmit_cmd() as the IO parameter")
> Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

This is all wrong in all possible ways :-( My excuse is the overnight
flight last night (no sleep). Mimi, I think what you first proposed as
the fix is the right way tho fix it. I'll take some sleep and after that
I'll make a legit commit with fix and a commit message explaining the
root cause.

Please try to ignore this.

/Jarkko

Re: [PATCH] tpm: Fix tpm_send() length calculation

[kbuild test robot]

[-- Attachment #1: Type: text/plain, Size: 2036 bytes --]

Hi Jarkko,

I love your patch! Yet something to improve:

[auto build test ERROR on jss-tpmdd/next]
[cannot apply to v5.3 next-20190915]
[if your patch is applied to the wrong git tree, please drop us a note to help improve the system]

url:    https://github.com/0day-ci/linux/commits/Jarkko-Sakkinen/tpm-Fix-tpm_send-length-calculation/20190916-162814
base:   git://git.infradead.org/users/jjs/linux-tpmdd next
config: x86_64-randconfig-a004-201937 (attached as .config)
compiler: gcc-7 (Debian 7.4.0-11) 7.4.0
reproduce:
        # save the attached .config to linux build tree
        make ARCH=x86_64 

If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   drivers/char/tpm/tpm-interface.c: In function 'tpm_send':
>> drivers/char/tpm/tpm-interface.c:366:5: error: 'struct tpm_buf' has no member named 'length'
     buf.length = buflen;
        ^

vim +366 drivers/char/tpm/tpm-interface.c

   343	
   344	/**
   345	 * tpm_send - send a TPM command
   346	 * @chip:	a &struct tpm_chip instance, %NULL for the default chip
   347	 * @cmd:	a TPM command buffer
   348	 * @buflen:	the length of the TPM command buffer
   349	 *
   350	 * Return: same as with tpm_transmit_cmd()
   351	 */
   352	int tpm_send(struct tpm_chip *chip, void *cmd, size_t buflen)
   353	{
   354		struct tpm_buf buf;
   355		int rc;
   356	
   357		chip = tpm_find_get_ops(chip);
   358		if (!chip)
   359			return -ENODEV;
   360	
   361		rc = tpm_buf_init(&buf, 0, 0);
   362		if (rc)
   363			goto out;
   364	
   365		memcpy(buf.data, cmd, buflen);
 > 366		buf.length = buflen;
   367	
   368		rc = tpm_transmit_cmd(chip, &buf, 0, "attempting to a send a command");
   369		tpm_buf_destroy(&buf);
   370	out:
   371		tpm_put_ops(chip);
   372		return rc;
   373	}
   374	EXPORT_SYMBOL_GPL(tpm_send);
   375	

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

[-- Attachment #2: .config.gz --]
[-- Type: application/gzip, Size: 25235 bytes --]