On Fri, 2021-01-29 at 08:58 -0500, Mimi Zohar wrote:
On Fri, 2021-01-29 at 01:56 +0200, jarkko@kernel.org wrote:
From: Jarkko Sakkinen jarkko@kernel.org
When TPM 2.0 trusted keys code was moved to the trusted keys subsystem, the operations were unwrapped from tpm_try_get_ops() and tpm_put_ops(), which are used to take temporarily the ownership of the TPM chip. The ownership is only taken inside tpm_send(), but this is not sufficient, as in the key load TPM2_CC_LOAD, TPM2_CC_UNSEAL and TPM2_FLUSH_CONTEXT need to be done as a one single atom.
Take the TPM chip ownership before sending anything with tpm_try_get_ops() and tpm_put_ops(), and use tpm_transmit_cmd() to send TPM commands instead of tpm_send(), reverting back to the old behaviour.
Fixes: 2e19e10131a0 ("KEYS: trusted: Move TPM2 trusted keys code") Reported-by: "James E.J. Bottomley" James.Bottomley@HansenPartnership.com Cc: stable@vger.kernel.org Cc: David Howells dhowells@redhat.com Cc: Mimi Zohar zohar@linux.ibm.com Cc: Sumit Garg sumit.garg@linaro.org Signed-off-by: Jarkko Sakkinen jarkko@kernel.org
Tested-by: Mimi Zohar zohar@linux.ibm.com (on TPM 1.2 & PTT, discrete TPM 2.0)
Thanks, is it OK to apply the whole series?
/Jarkko
On Sat, 2021-01-30 at 23:28 +0200, Jarkko Sakkinen wrote:
On Fri, 2021-01-29 at 08:58 -0500, Mimi Zohar wrote:
On Fri, 2021-01-29 at 01:56 +0200, jarkko@kernel.org wrote:
From: Jarkko Sakkinen jarkko@kernel.org
When TPM 2.0 trusted keys code was moved to the trusted keys subsystem, the operations were unwrapped from tpm_try_get_ops() and tpm_put_ops(), which are used to take temporarily the ownership of the TPM chip. The ownership is only taken inside tpm_send(), but this is not sufficient, as in the key load TPM2_CC_LOAD, TPM2_CC_UNSEAL and TPM2_FLUSH_CONTEXT need to be done as a one single atom.
Take the TPM chip ownership before sending anything with tpm_try_get_ops() and tpm_put_ops(), and use tpm_transmit_cmd() to send TPM commands instead of tpm_send(), reverting back to the old behaviour.
Fixes: 2e19e10131a0 ("KEYS: trusted: Move TPM2 trusted keys code") Reported-by: "James E.J. Bottomley" James.Bottomley@HansenPartnership.com Cc: stable@vger.kernel.org Cc: David Howells dhowells@redhat.com Cc: Mimi Zohar zohar@linux.ibm.com Cc: Sumit Garg sumit.garg@linaro.org Signed-off-by: Jarkko Sakkinen jarkko@kernel.org
Tested-by: Mimi Zohar zohar@linux.ibm.com (on TPM 1.2 & PTT, discrete TPM 2.0)
Thanks, is it OK to apply the whole series?
Yes. The testing was with the entire patch set, but I didn't explicitly test each change. For the other two patches, please add my Reviewed-by.
Mimi
On Sun, Jan 31, 2021 at 07:52:42AM -0500, Mimi Zohar wrote:
On Sat, 2021-01-30 at 23:28 +0200, Jarkko Sakkinen wrote:
On Fri, 2021-01-29 at 08:58 -0500, Mimi Zohar wrote:
On Fri, 2021-01-29 at 01:56 +0200, jarkko@kernel.org wrote:
From: Jarkko Sakkinen jarkko@kernel.org
When TPM 2.0 trusted keys code was moved to the trusted keys subsystem, the operations were unwrapped from tpm_try_get_ops() and tpm_put_ops(), which are used to take temporarily the ownership of the TPM chip. The ownership is only taken inside tpm_send(), but this is not sufficient, as in the key load TPM2_CC_LOAD, TPM2_CC_UNSEAL and TPM2_FLUSH_CONTEXT need to be done as a one single atom.
Take the TPM chip ownership before sending anything with tpm_try_get_ops() and tpm_put_ops(), and use tpm_transmit_cmd() to send TPM commands instead of tpm_send(), reverting back to the old behaviour.
Fixes: 2e19e10131a0 ("KEYS: trusted: Move TPM2 trusted keys code") Reported-by: "James E.J. Bottomley" James.Bottomley@HansenPartnership.com Cc: stable@vger.kernel.org Cc: David Howells dhowells@redhat.com Cc: Mimi Zohar zohar@linux.ibm.com Cc: Sumit Garg sumit.garg@linaro.org Signed-off-by: Jarkko Sakkinen jarkko@kernel.org
Tested-by: Mimi Zohar zohar@linux.ibm.com (on TPM 1.2 & PTT, discrete TPM 2.0)
Thanks, is it OK to apply the whole series?
Yes. The testing was with the entire patch set, but I didn't explicitly test each change. For the other two patches, please add my Reviewed-by.
Mimi
Thank you. I will do that.
/Jarkko
linux-stable-mirror@lists.linaro.org
-
Jarkko Sakkinen -
Mimi Zohar