A "get random" may fail with a TPM error, but those codes were returned as-is to the caller, which assumed the result was the number of bytes that had been written to the target buffer, which could lead to a kernel heap memory exposure and over-read. This fixes tpm1_get_random() and tpm2_get_random() to mask positive TPM errors into -EIO while still passing through any negative errors. [ 18.092103] tpm tpm0: A TPM error (379) occurred attempting get random [ 18.092106] usercopy: Kernel memory exposure attempt detected from SLUB object 'kmalloc-64' (offset 0, size 379)! Link: https://bugzilla.redhat.com/show_bug.cgi?id=1650989 Reported-by: Phil Baker <baker1tex@xxxxxxxxx> Reported-by: Craig Robson <craig@xxxxxxxxx> Fixes: 7aee9c52d7ac ("tpm: tpm1: rewrite tpm1_get_random() using tpm_buf structure") Fixes: ce63c05b664e ("tpm: migrate tpm2_get_random() to use struct tpm_buf") Cc: Laura Abbott <labbott@xxxxxxxxxx> Cc: Tomas Winkler <tomas.winkler@xxxxxxxxx> Cc: Jarkko Sakkinen <jarkko.sakkinen@xxxxxxxxxxxxxxx> Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Kees Cook <keescook@xxxxxxxxxxxx> --- v2: - also fix tpm2 implementation (Jason Gunthorpe) --- drivers/char/tpm/tpm1-cmd.c | 7 +++++-- drivers/char/tpm/tpm2-cmd.c | 7 +++++-- 2 files changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/char/tpm/tpm1-cmd.c b/drivers/char/tpm/tpm1-cmd.c index 85dcf2654d11..8e17d4f30aeb 100644 --- a/drivers/char/tpm/tpm1-cmd.c +++ b/drivers/char/tpm/tpm1-cmd.c @@ -510,7 +510,7 @@ struct tpm1_get_random_out { * * Return: * * number of bytes read - * * -errno or a TPM return code otherwise + * * -errno (positive TPM return codes are masked to -EIO) */ int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max) { @@ -524,7 +524,7 @@ int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max) rc = tpm_buf_init(&buf, TPM_TAG_RQU_COMMAND, TPM_ORD_GET_RANDOM); if (rc) - return rc; + goto fail; do { tpm_buf_append_u32(&buf, num_bytes); @@ -559,6 +559,9 @@ int tpm1_get_random(struct tpm_chip *chip, u8 *dest, size_t max) rc = total ? (int)total : -EIO; out: tpm_buf_destroy(&buf); +fail: + if (rc > 0) + rc = -EIO; return rc; } diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c index e74c5b7b64bf..dd0677f50f9c 100644 --- a/drivers/char/tpm/tpm2-cmd.c +++ b/drivers/char/tpm/tpm2-cmd.c @@ -301,7 +301,7 @@ struct tpm2_get_random_out { * * Return: * size of the buffer on success, - * -errno otherwise + * -errno otherwise ((positive TPM return codes are masked to -EIO) */ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) { @@ -319,7 +319,7 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) err = tpm_buf_init(&buf, 0, 0); if (err) - return err; + goto fail; do { tpm_buf_reset(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_GET_RANDOM); @@ -352,6 +352,9 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max) return total ? total : -EIO; out: tpm_buf_destroy(&buf); +fail: + if (err > 0) + erro = -EIO; return err; } -- 2.17.1 -- Kees Cook
