From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id C14DCC43381 for ; Thu, 21 Mar 2019 10:13:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8C39F218AE for ; Thu, 21 Mar 2019 10:13:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1553163200; bh=2LWM7Zf7cJtF3aKlAUZxrqgbpIjEGGkLNL4sGHrXyeQ=; h=Subject:To:Cc:From:Date:List-ID:From; b=ebJM/LeUPyP93100B4Cn8MPqx4DSt44B8Hdera2FprwbxyDl/S7vsCgH/1HmhAptH tQYppejVDI3uRj7TAy6Mr9eCp+zan8c2ZIgmIxLBs6gIFbByI/J/K+HHrFCN9e3Oxh tue25s8A/K8fofdFUTdJ1zEhj3VzvVusljQJ+l44= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727915AbfCUKNU (ORCPT ); Thu, 21 Mar 2019 06:13:20 -0400 Received: from out5-smtp.messagingengine.com ([66.111.4.29]:43411 "EHLO out5-smtp.messagingengine.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727913AbfCUKNT (ORCPT ); Thu, 21 Mar 2019 06:13:19 -0400 Received: from compute6.internal (compute6.nyi.internal [10.202.2.46]) by mailout.nyi.internal (Postfix) with ESMTP id 8F81A231C6; Thu, 21 Mar 2019 06:13:18 -0400 (EDT) Received: from mailfrontend1 ([10.202.2.162]) by compute6.internal (MEProxy); Thu, 21 Mar 2019 06:13:18 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:content-transfer-encoding:content-type :date:from:message-id:mime-version:subject:to:x-me-proxy :x-me-proxy:x-me-sender:x-me-sender:x-sasl-enc; s=fm2; bh=uprO5t 37v5MaVdncIIkyNIozFnjaGLru+m3BNwZNN2c=; b=FMs/x2z23QvvLfY3uqIHJa WgW2Yw/+ew0p/0NQCAeewMj2UGCqVcOVSp4eK1C0OWtVsDenjB8pBDStPiXkU18L G0eMVce6QLBLg6EjK+rKhsVXei/KLMRaAIC7V7HsIHLBgbvIaMy0Ze4h4unONr1Y ObiQEj/vVShyseM6LfmM16SU8YOhGFWs1Q1tixD1v9FXNAk8wGkkLNuJRbd3xsMM ZLVmagChrf3+kIFPQbibbvfaUpavKuMR6Wa7ZGQKxv8A3PkeykuXIo+o3nSQUgBJ UdizuGQ2UwrYR4akNi8Rg7kYnas1B3YdyIBP1oYfNEGdLuSC3ZCamojmietNsCjA == X-ME-Sender: X-ME-Proxy-Cause: gggruggvucftvghtrhhoucdtuddrgedutddrieelucetufdoteggodetrfdotffvucfrrh hofhhilhgvmecuhfgrshhtofgrihhlpdfqfgfvpdfurfetoffkrfgpnffqhgenuceurghi lhhouhhtmecufedttdenucgoufhorhhtvggutfgvtghiphdvucdlgedtmdenucfjughrpe fuvffhfffkgggtgfesthekredttddtlfenucfhrhhomhepoehgrhgvghhkhheslhhinhhu gihfohhunhgurghtihhonhdrohhrgheqnecukfhppeelhedrleekrddvjedrudekjeenuc frrghrrghmpehmrghilhhfrhhomhepghhrvghgsehkrhhorghhrdgtohhmnecuvehluhhs thgvrhfuihiivgepud X-ME-Proxy: Received: from localhost (unknown [95.98.27.187]) by mail.messagingengine.com (Postfix) with ESMTPA id 512DBE46B8; Thu, 21 Mar 2019 06:13:15 -0400 (EDT) Subject: FAILED: patch "[PATCH] tpm/tpm_crb: Avoid unaligned reads in crb_recv()" failed to apply to 4.9-stable tree To: jarkko.sakkinen@linux.intel.com, jmorris@namei.org, jsnitsel@redhat.com, tomas.winkler@intel.com Cc: From: Date: Thu, 21 Mar 2019 11:13:14 +0100 Message-ID: <1553163194102113@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: stable@vger.kernel.org The patch below does not apply to the 4.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to . thanks, greg k-h ------------------ original commit in Linus's tree ------------------ >From 3d7a850fdc1a2e4d2adbc95cc0fc962974725e88 Mon Sep 17 00:00:00 2001 From: Jarkko Sakkinen Date: Mon, 4 Feb 2019 15:59:43 +0200 Subject: [PATCH] tpm/tpm_crb: Avoid unaligned reads in crb_recv() The current approach to read first 6 bytes from the response and then tail of the response, can cause the 2nd memcpy_fromio() to do an unaligned read (e.g. read 32-bit word from address aligned to a 16-bits), depending on how memcpy_fromio() is implemented. If this happens, the read will fail and the memory controller will fill the read with 1's. This was triggered by 170d13ca3a2f, which should be probably refined to check and react to the address alignment. Before that commit, on x86 memcpy_fromio() turned out to be memcpy(). By a luck GCC has done the right thing (from tpm_crb's perspective) for us so far, but we should not rely on that. Thus, it makes sense to fix this also in tpm_crb, not least because the fix can be then backported to stable kernels and make them more robust when compiled in differing environments. Cc: stable@vger.kernel.org Cc: James Morris Cc: Tomas Winkler Cc: Jerry Snitselaar Fixes: 30fc8d138e91 ("tpm: TPM 2.0 CRB Interface") Signed-off-by: Jarkko Sakkinen Reviewed-by: Jerry Snitselaar Acked-by: Tomas Winkler diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c index 36952ef98f90..763fc7e6c005 100644 --- a/drivers/char/tpm/tpm_crb.c +++ b/drivers/char/tpm/tpm_crb.c @@ -287,19 +287,29 @@ static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count) struct crb_priv *priv = dev_get_drvdata(&chip->dev); unsigned int expected; - /* sanity check */ - if (count < 6) + /* A sanity check that the upper layer wants to get at least the header + * as that is the minimum size for any TPM response. + */ + if (count < TPM_HEADER_SIZE) return -EIO; + /* If this bit is set, according to the spec, the TPM is in + * unrecoverable condition. + */ if (ioread32(&priv->regs_t->ctrl_sts) & CRB_CTRL_STS_ERROR) return -EIO; - memcpy_fromio(buf, priv->rsp, 6); - expected = be32_to_cpup((__be32 *) &buf[2]); - if (expected > count || expected < 6) + /* Read the first 8 bytes in order to get the length of the response. + * We read exactly a quad word in order to make sure that the remaining + * reads will be aligned. + */ + memcpy_fromio(buf, priv->rsp, 8); + + expected = be32_to_cpup((__be32 *)&buf[2]); + if (expected > count || expected < TPM_HEADER_SIZE) return -EIO; - memcpy_fromio(&buf[6], &priv->rsp[6], expected - 6); + memcpy_fromio(&buf[8], &priv->rsp[8], expected - 8); return expected; }