mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 15:47:36 +00:00
tpm: fix race condition in tpm_common_write()
There is a race condition in tpm_common_write function allowing
two threads on the same /dev/tpm<N>, or two different applications
on the same /dev/tpmrm<N> to overwrite each other commands/responses.
Fixed this by taking the priv->buffer_mutex early in the function.
Also converted the priv->data_pending from atomic to a regular size_t
type. There is no need for it to be atomic since it is only touched
under the protection of the priv->buffer_mutex.
Fixes: 1da177e4c3
("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
This commit is contained in:
parent
424eaf910c
commit
3ab2011ea3
2 changed files with 20 additions and 24 deletions
|
@ -37,7 +37,7 @@ static void timeout_work(struct work_struct *work)
|
||||||
struct file_priv *priv = container_of(work, struct file_priv, work);
|
struct file_priv *priv = container_of(work, struct file_priv, work);
|
||||||
|
|
||||||
mutex_lock(&priv->buffer_mutex);
|
mutex_lock(&priv->buffer_mutex);
|
||||||
atomic_set(&priv->data_pending, 0);
|
priv->data_pending = 0;
|
||||||
memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
|
memset(priv->data_buffer, 0, sizeof(priv->data_buffer));
|
||||||
mutex_unlock(&priv->buffer_mutex);
|
mutex_unlock(&priv->buffer_mutex);
|
||||||
}
|
}
|
||||||
|
@ -46,7 +46,6 @@ void tpm_common_open(struct file *file, struct tpm_chip *chip,
|
||||||
struct file_priv *priv)
|
struct file_priv *priv)
|
||||||
{
|
{
|
||||||
priv->chip = chip;
|
priv->chip = chip;
|
||||||
atomic_set(&priv->data_pending, 0);
|
|
||||||
mutex_init(&priv->buffer_mutex);
|
mutex_init(&priv->buffer_mutex);
|
||||||
timer_setup(&priv->user_read_timer, user_reader_timeout, 0);
|
timer_setup(&priv->user_read_timer, user_reader_timeout, 0);
|
||||||
INIT_WORK(&priv->work, timeout_work);
|
INIT_WORK(&priv->work, timeout_work);
|
||||||
|
@ -58,29 +57,24 @@ ssize_t tpm_common_read(struct file *file, char __user *buf,
|
||||||
size_t size, loff_t *off)
|
size_t size, loff_t *off)
|
||||||
{
|
{
|
||||||
struct file_priv *priv = file->private_data;
|
struct file_priv *priv = file->private_data;
|
||||||
ssize_t ret_size;
|
ssize_t ret_size = 0;
|
||||||
ssize_t orig_ret_size;
|
|
||||||
int rc;
|
int rc;
|
||||||
|
|
||||||
del_singleshot_timer_sync(&priv->user_read_timer);
|
del_singleshot_timer_sync(&priv->user_read_timer);
|
||||||
flush_work(&priv->work);
|
flush_work(&priv->work);
|
||||||
ret_size = atomic_read(&priv->data_pending);
|
|
||||||
if (ret_size > 0) { /* relay data */
|
|
||||||
orig_ret_size = ret_size;
|
|
||||||
if (size < ret_size)
|
|
||||||
ret_size = size;
|
|
||||||
|
|
||||||
mutex_lock(&priv->buffer_mutex);
|
mutex_lock(&priv->buffer_mutex);
|
||||||
|
|
||||||
|
if (priv->data_pending) {
|
||||||
|
ret_size = min_t(ssize_t, size, priv->data_pending);
|
||||||
rc = copy_to_user(buf, priv->data_buffer, ret_size);
|
rc = copy_to_user(buf, priv->data_buffer, ret_size);
|
||||||
memset(priv->data_buffer, 0, orig_ret_size);
|
memset(priv->data_buffer, 0, priv->data_pending);
|
||||||
if (rc)
|
if (rc)
|
||||||
ret_size = -EFAULT;
|
ret_size = -EFAULT;
|
||||||
|
|
||||||
mutex_unlock(&priv->buffer_mutex);
|
priv->data_pending = 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
atomic_set(&priv->data_pending, 0);
|
mutex_unlock(&priv->buffer_mutex);
|
||||||
|
|
||||||
return ret_size;
|
return ret_size;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
@ -91,18 +85,20 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf,
|
||||||
size_t in_size = size;
|
size_t in_size = size;
|
||||||
ssize_t out_size;
|
ssize_t out_size;
|
||||||
|
|
||||||
/* Cannot perform a write until the read has cleared either via
|
|
||||||
* tpm_read or a user_read_timer timeout. This also prevents split
|
|
||||||
* buffered writes from blocking here.
|
|
||||||
*/
|
|
||||||
if (atomic_read(&priv->data_pending) != 0)
|
|
||||||
return -EBUSY;
|
|
||||||
|
|
||||||
if (in_size > TPM_BUFSIZE)
|
if (in_size > TPM_BUFSIZE)
|
||||||
return -E2BIG;
|
return -E2BIG;
|
||||||
|
|
||||||
mutex_lock(&priv->buffer_mutex);
|
mutex_lock(&priv->buffer_mutex);
|
||||||
|
|
||||||
|
/* Cannot perform a write until the read has cleared either via
|
||||||
|
* tpm_read or a user_read_timer timeout. This also prevents split
|
||||||
|
* buffered writes from blocking here.
|
||||||
|
*/
|
||||||
|
if (priv->data_pending != 0) {
|
||||||
|
mutex_unlock(&priv->buffer_mutex);
|
||||||
|
return -EBUSY;
|
||||||
|
}
|
||||||
|
|
||||||
if (copy_from_user
|
if (copy_from_user
|
||||||
(priv->data_buffer, (void __user *) buf, in_size)) {
|
(priv->data_buffer, (void __user *) buf, in_size)) {
|
||||||
mutex_unlock(&priv->buffer_mutex);
|
mutex_unlock(&priv->buffer_mutex);
|
||||||
|
@ -132,7 +128,7 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf,
|
||||||
return out_size;
|
return out_size;
|
||||||
}
|
}
|
||||||
|
|
||||||
atomic_set(&priv->data_pending, out_size);
|
priv->data_pending = out_size;
|
||||||
mutex_unlock(&priv->buffer_mutex);
|
mutex_unlock(&priv->buffer_mutex);
|
||||||
|
|
||||||
/* Set a timeout by which the reader must come claim the result */
|
/* Set a timeout by which the reader must come claim the result */
|
||||||
|
@ -149,5 +145,5 @@ void tpm_common_release(struct file *file, struct file_priv *priv)
|
||||||
del_singleshot_timer_sync(&priv->user_read_timer);
|
del_singleshot_timer_sync(&priv->user_read_timer);
|
||||||
flush_work(&priv->work);
|
flush_work(&priv->work);
|
||||||
file->private_data = NULL;
|
file->private_data = NULL;
|
||||||
atomic_set(&priv->data_pending, 0);
|
priv->data_pending = 0;
|
||||||
}
|
}
|
||||||
|
|
|
@ -8,7 +8,7 @@ struct file_priv {
|
||||||
struct tpm_chip *chip;
|
struct tpm_chip *chip;
|
||||||
|
|
||||||
/* Data passed to and from the tpm via the read/write calls */
|
/* Data passed to and from the tpm via the read/write calls */
|
||||||
atomic_t data_pending;
|
size_t data_pending;
|
||||||
struct mutex buffer_mutex;
|
struct mutex buffer_mutex;
|
||||||
|
|
||||||
struct timer_list user_read_timer; /* user needs to claim result */
|
struct timer_list user_read_timer; /* user needs to claim result */
|
||||||
|
|
Loading…
Reference in a new issue