From patchwork Thu Jan 30 10:23:17 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vasily Averin X-Patchwork-Id: 11357693 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BE540188B for ; Thu, 30 Jan 2020 10:23:24 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 991EF2082E for ; Thu, 30 Jan 2020 10:23:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727036AbgA3KXY (ORCPT ); Thu, 30 Jan 2020 05:23:24 -0500 Received: from relay.sw.ru ([185.231.240.75]:49630 "EHLO relay.sw.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726922AbgA3KXY (ORCPT ); Thu, 30 Jan 2020 05:23:24 -0500 Received: from vvs-ws.sw.ru ([172.16.24.21]) by relay.sw.ru with esmtp (Exim 4.92.3) (envelope-from ) id 1ix6yj-0003u1-Mp; Thu, 30 Jan 2020 13:23:17 +0300 From: Vasily Averin Subject: [PATCH v2 1/2] tpm: tpm1_bios_measurements_next should increase position index To: linux-integrity@vger.kernel.org Cc: Peter Huewe , Jarkko Sakkinen , Jason Gunthorpe References: Message-ID: <3f4f2483-66cf-8693-986d-bf2821cdd879@virtuozzo.com> Date: Thu, 30 Jan 2020 13:23:17 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org If seq_file .next function does not change position index, read after non-zero lseek can generate unexpected output. In case of /sys/kernel/security/tpm0/ascii_bios_measurements and binary_bios_measurements: 1) read after lseek beyond end of file generates whole last line. 2) read after lseek to middle of last line generates expected end of last line and unexpected whole last line once again. Cc: stable@vger.kernel.org Fixes: 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code ...") https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin --- drivers/char/tpm/eventlog/tpm1.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/tpm/eventlog/tpm1.c b/drivers/char/tpm/eventlog/tpm1.c index 739b1d9..2c96977 100644 --- a/drivers/char/tpm/eventlog/tpm1.c +++ b/drivers/char/tpm/eventlog/tpm1.c @@ -115,6 +115,7 @@ static void *tpm1_bios_measurements_next(struct seq_file *m, void *v, u32 converted_event_size; u32 converted_event_type; + (*pos)++; converted_event_size = do_endian_conversion(event->event_size); v += sizeof(struct tcpa_event) + converted_event_size; @@ -132,7 +133,6 @@ static void *tpm1_bios_measurements_next(struct seq_file *m, void *v, ((v + sizeof(struct tcpa_event) + converted_event_size) > limit)) return NULL; - (*pos)++; return v; } From patchwork Thu Jan 30 10:23:21 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vasily Averin X-Patchwork-Id: 11357695 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C3F831800 for ; Thu, 30 Jan 2020 10:23:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A28822082E for ; Thu, 30 Jan 2020 10:23:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726893AbgA3KXZ (ORCPT ); Thu, 30 Jan 2020 05:23:25 -0500 Received: from relay.sw.ru ([185.231.240.75]:49632 "EHLO relay.sw.ru" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727077AbgA3KXZ (ORCPT ); Thu, 30 Jan 2020 05:23:25 -0500 Received: from vvs-ws.sw.ru ([172.16.24.21]) by relay.sw.ru with esmtp (Exim 4.92.3) (envelope-from ) id 1ix6yn-0003u4-VD; Thu, 30 Jan 2020 13:23:22 +0300 From: Vasily Averin Subject: [PATCH v2 2/2] tpm: tpm2_bios_measurements_next should increase position index To: linux-integrity@vger.kernel.org Cc: Peter Huewe , Jarkko Sakkinen , Jason Gunthorpe References: Message-ID: <16bde2d6-4208-e478-0ac3-163b5c3a1eaa@virtuozzo.com> Date: Thu, 30 Jan 2020 13:23:21 +0300 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org If seq_file .next function does not change position index, read after non-zero lseek can generate unexpected output. For /sys/kernel/security/tpm0/binary_bios_measurements: 1) read after lseek beyond end of file generates whole last line. 2) read after lseek to middle of last line generates expected end of last line and unexpected whole last line once again. Cc: stable@vger.kernel.org Fixes: 1f4aace60b0e ("fs/seq_file.c: simplify seq_file iteration code ...") https://bugzilla.kernel.org/show_bug.cgi?id=206283 Signed-off-by: Vasily Averin --- drivers/char/tpm/eventlog/tpm2.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/tpm/eventlog/tpm2.c b/drivers/char/tpm/eventlog/tpm2.c index b9aeda1..e741b11 100644 --- a/drivers/char/tpm/eventlog/tpm2.c +++ b/drivers/char/tpm/eventlog/tpm2.c @@ -94,6 +94,7 @@ static void *tpm2_bios_measurements_next(struct seq_file *m, void *v, size_t event_size; void *marker; + (*pos)++; event_header = log->bios_event_log; if (v == SEQ_START_TOKEN) { @@ -118,7 +119,6 @@ static void *tpm2_bios_measurements_next(struct seq_file *m, void *v, if (((v + event_size) >= limit) || (event_size == 0)) return NULL; - (*pos)++; return v; }