[tpm2] Re: Tss2_Tcti_Device_Init context not zeroed
Roberts, William C <william.c.roberts at intel.com> Thu, 14 Jul 2022 14:09:44 +0000
| Newsgroups | dev.linux.lists.tpm2 |
|---|---|
| Message-ID | <SN6PR11MB343764654CBF1EFA2C9EC7D2B8889@SN6PR11MB3437.namprd11.prod.outlook.com> |
Good sleuthing, I still wonder though, looking at all the tcti code, if a memset 0 is still
worth it in all the init functions to prevent this from happening again. Looking at the rest
of the tcti's they all look fine AFAICT.
________________________________
From: Antonio de Moraes, Marcos <marcos.antonio-de-moraes(a)hpe.com>
Sent: Wednesday, July 13, 2022 4:50 PM
To: Roberts, William C <william.c.roberts(a)intel.com>; tpm2(a)lists.01.org <tpm2(a)lists.01.org>
Subject: RE: Tss2_Tcti_Device_Init context not zeroed
Thanks Willian!
I found that the issue that I reported is already fixed on commit [fda07f78d93a85b7146501b70d8e655d92783fb4] tcti-device: 'partial' may be used uninitialized
<
commit fda07f78d93a85b7146501b70d8e655d92783fb4 (HEAD)
Author: Jeffrey Ferreira jeffpferreira(a)gmail.com<mailto:jeffpferreira(a)gmail.com>
Date: Tue Mar 30 12:15:01 2021 -0700
tcti-device: 'partial' may be used uninitialized
If partial read is not supported then tcti_common->partial will be used
uninitialized in tcti_device_receive().
Signed-off-by: Jeffrey Ferreira jeffpferreira(a)gmail.com<mailto:jeffpferreira(a)gmail.com>
diff --git a/src/tss2-tcti/tcti-device.c b/src/tss2-tcti/tcti-device.c
index c606bad1..21a1652f 100644
--- a/src/tss2-tcti/tcti-device.c
+++ b/src/tss2-tcti/tcti-device.c
@@ -412,6 +412,7 @@ Tss2_Tcti_Device_Init (
tcti_common->state = TCTI_STATE_TRANSMIT;
memset (&tcti_common->header, 0, sizeof (tcti_common->header));
tcti_common->locality = 3;
+ tcti_common->partial = false;
if (conf == NULL) {
LOG_TRACE ("No TCTI device file specified");
>
Taking the release 3.20 - it has this commit- I built and installed it on my system and now I no longer need to provide a zeroed context memory block to Tss2_Tcti_Device_Init.
Thank you,
Marcos Moraes
From: Roberts, William C <william.c.roberts(a)intel.com>
Sent: terça-feira, 12 de julho de 2022 10:53
To: Antonio de Moraes, Marcos <marcos.antonio-de-moraes(a)hpe.com>; tpm2(a)lists.01.org
Subject: Re: Tss2_Tcti_Device_Init context not zeroed
+ list
> 1 – Is mandatory zeroing it before calling Tss2_Tcti_Device_Init? If so, is it a case of missing specification?
No it shouldn't be required IIUC
> 2 – No, it isn’t, so is there a bug?
Looks like a bug and it looks consistent throughout all the init routines for TCTIs.
________________________________
From: Antonio de Moraes, Marcos <marcos.antonio-de-moraes(a)hpe.com<mailto:marcos.antonio-de-moraes(a)hpe.com>>
Sent: Monday, July 11, 2022 1:21 PM
To: tpm2-owner(a)lists.01.org<mailto:tpm2-owner(a)lists.01.org> <tpm2-owner(a)lists.01.org<mailto:tpm2-owner(a)lists.01.org>>
Subject: Tss2_Tcti_Device_Init context not zeroed
Hi all,
I noticed when performing subsequent tpm2 calls over a not zeroed tcti context passed to Tss2_Tcti_Device_Init I have errors such as:
“WARNING:tcti:src/tss2-tcti/tcti-device.c:321:tcti_device_receive() TPM2 response size disagrees with number of bytes read from fd 3. Header says 0 but we read 29 bytes.
ERROR:sys:src/tss2-sys/api/Tss2_Sys_Execute.c:118:Tss2_Sys_ExecuteFinish() Malformed response: Invalid tag in response header: 0”
I made some experiments: If I put some content different than 0x00 at offset 89 in memory block passed to RC Tss2_Tcti_Device_Init it fails. That is also true for some other offsets.
TSS2_RC Tss2_Tcti_Device_Init (TSS2_TCTI_CONTEXT *tctiContext, size_t *size, const char *conf);
I check the description of Tss2_Tcti_Device_Init and didn’t find any observation that tctiContext parameter must point an zeroed memory block, although in the usage examples the allocated memory is zeroed , calling calloc( 1, <needed size>).
Regarding tctiContext memory block passed to Tss2_Tcti_Device_Init:
1 – Is mandatory zeroing it before calling Tss2_Tcti_Device_Init? If so, is it a case of missing specification?
2 – No, it isn’t, so is there a bug?
My environment:
TCTI shared library: libtss2-tcti-device.so.0
OS: Enterprise Suse Linux
Thanks in advance,
Marcos A. de Moraes
HPE Security Software Engineer
attachment.htm
(text/html, 10.2 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Good sleuthing, I still wonder though, looking at all the tcti code, if a memset 0 is still</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
worth it in all the init functions to prevent this from happening again. Looking at the rest</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
of the tcti's they all look fine AFAICT.</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Antonio de Moraes, Marcos <[email protected]><br>
<b>Sent:</b> Wednesday, July 13, 2022 4:50 PM<br>
<b>To:</b> Roberts, William C <[email protected]>; [email protected] <[email protected]><br>
<b>Subject:</b> RE: Tss2_Tcti_Device_Init context not zeroed</font>
<div> </div>
</div>
<style>
<!--
@font-face
{font-family:"Cambria Math"}
@font-face
{font-family:Calibri}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
a:link, span.x_MsoHyperlink
{color:#0563C1;
text-decoration:underline}
p.x_xmsonormal, li.x_xmsonormal, div.x_xmsonormal
{margin:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif}
span.x_EmailStyle20
{font-family:"Calibri",sans-serif;
color:windowtext}
.x_MsoChpDefault
{font-size:10.0pt}
@page WordSection1
{margin:72.0pt 72.0pt 72.0pt 72.0pt}
div.x_WordSection1
{}
-->
</style>
<div lang="EN-GB" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="x_WordSection1">
<p class="x_MsoNormal"><span style="">Thanks Willian!</span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><span style="">I found that the issue that I reported is already fixed on commit
<b>[fda07f78d93a85b7146501b70d8e655d92783fb4] tcti-device: 'partial' may be used uninitialized</b></span></p>
<p class="x_MsoNormal"><b><span style=""><</span></b><span style=""> </span></p>
<p class="x_MsoNormal"><span style="">commit fda07f78d93a85b7146501b70d8e655d92783fb4 (HEAD)</span></p>
<p class="x_MsoNormal"><span style="">Author: Jeffrey Ferreira <a href="mailto:[email protected]">
[email protected]</a></span></p>
<p class="x_MsoNormal"><span style="">Date: Tue Mar 30 12:15:01 2021 -0700</span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><span style=""> tcti-device: 'partial' may be used uninitialized</span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><span style=""> If partial read is not supported then tcti_common->partial will be used</span></p>
<p class="x_MsoNormal"><span style=""> uninitialized in tcti_device_receive().</span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><span style=""> Signed-off-by: Jeffrey Ferreira <a href="mailto:[email protected]">
[email protected]</a></span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><span style="">diff --git a/src/tss2-tcti/tcti-device.c b/src/tss2-tcti/tcti-device.c</span></p>
<p class="x_MsoNormal"><span style="">index c606bad1..21a1652f 100644</span></p>
<p class="x_MsoNormal"><span style="">--- a/src/tss2-tcti/tcti-device.c</span></p>
<p class="x_MsoNormal"><span style="">+++ b/src/tss2-tcti/tcti-device.c</span></p>
<p class="x_MsoNormal"><span style="">@@ -412,6 +412,7 @@ Tss2_Tcti_Device_Init (</span></p>
<p class="x_MsoNormal"><span style=""> tcti_common->state = TCTI_STATE_TRANSMIT;</span></p>
<p class="x_MsoNormal"><span style=""> memset (&tcti_common->header, 0, sizeof (tcti_common->header));</span></p>
<p class="x_MsoNormal"><span style=""> tcti_common->locality = 3;</span></p>
<p class="x_MsoNormal"><span style="">+ tcti_common->partial = false;</span></p>
<p class="x_MsoNormal"><span style=""></span></p>
<p class="x_MsoNormal"><span style=""> if (conf == NULL) {</span></p>
<p class="x_MsoNormal"><span style=""> LOG_TRACE ("No TCTI device file specified");</span></p>
<p class="x_MsoNormal"><span style="">> </span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><span style="">Taking the release 3.20 - it has this commit- I built and installed it on my system and now I no longer need to provide a zeroed context memory block to
</span>Tss2_Tcti_Device_Init.</p>
<p class="x_MsoNormal"> </p>
<p class="x_MsoNormal">Thank you,</p>
<p class="x_MsoNormal">Marcos Moraes</p>
<p class="x_MsoNormal"><span style=""> </span></p>
<p class="x_MsoNormal"><span style=""> </span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<p class="x_MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Roberts, William C <[email protected]>
<br>
<b>Sent:</b> terça-feira, 12 de julho de 2022 10:53<br>
<b>To:</b> Antonio de Moraes, Marcos <[email protected]>; [email protected]<br>
<b>Subject:</b> Re: Tss2_Tcti_Device_Init context not zeroed</span></p>
</div>
</div>
<p class="x_MsoNormal"> </p>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">+ list</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">> 1 Is mandatory zeroing it before calling Tss2_Tcti_Device_Init? If so, is it a case of missing specification?</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">No it shouldn't be required IIUC</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">> 2 No, it isnt, so is there a bug?</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black"> </span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">Looks like a bug and it looks consistent throughout all the init routines for TCTIs.</span></p>
</div>
<div class="x_MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="x_divRplyFwdMsg">
<p class="x_MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> Antonio de Moraes, Marcos <</span><a href="mailto:[email protected]">[email protected]</a><span style="color:black">><br>
<b>Sent:</b> Monday, July 11, 2022 1:21 PM<br>
<b>To:</b> </span><a href="mailto:[email protected]">[email protected]</a><span style="color:black"> <</span><a href="mailto:[email protected]">[email protected]</a><span style="color:black">><br>
<b>Subject:</b> Tss2_Tcti_Device_Init context not zeroed</span> </p>
<div>
<p class="x_MsoNormal"> </p>
</div>
</div>
<div>
<div>
<p class="x_xmsonormal">Hi all,</p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal"> I noticed when performing subsequent tpm2 calls over a not zeroed tcti context passed to Tss2_Tcti_Device_Init I have errors such as:</p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal">WARNING:tcti:src/tss2-tcti/tcti-device.c:321:tcti_device_receive() TPM2 response size disagrees with number of bytes read from fd 3<b>. Header says 0 but we read 29 bytes</b>.
</p>
<p class="x_xmsonormal">ERROR:sys:src/tss2-sys/api/Tss2_Sys_Execute.c:118:Tss2_Sys_ExecuteFinish() Malformed response: Invalid tag in response header: 0</p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal">I made some experiments: If I put some content different than 0x00 at offset 89 in memory block passed to RC Tss2_Tcti_Device_Init it fails. That is also true for some other offsets.</p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal">TSS2_RC Tss2_Tcti_Device_Init (TSS2_TCTI_CONTEXT *tctiContext, size_t *size, const char *conf);</p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal">I check the description of Tss2_Tcti_Device_Init and didnt find any observation that tctiContext parameter must point an zeroed memory block, although in the usage examples the allocated memory is zeroed , calling calloc( 1, <needed
size>).</p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal">Regarding tctiContext memory block passed to Tss2_Tcti_Device_Init:</p>
<p class="x_xmsonormal" style="text-indent:36.0pt">1 Is mandatory zeroing it before calling Tss2_Tcti_Device_Init? If so, is it a case of missing specification?</p>
<p class="x_xmsonormal" style="text-indent:36.0pt">2 No, it isnt, so is there a bug?</p>
<p class="x_xmsonormal" style="text-indent:36.0pt"> </p>
<p class="x_xmsonormal">My environment:</p>
<p class="x_xmsonormal" style="text-indent:36.0pt">TCTI shared library: libtss2-tcti-device.so.0</p>
<p class="x_xmsonormal" style="text-indent:36.0pt">OS: Enterprise Suse Linux</p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal">Thanks in advance,</p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal">Marcos A. de Moraes</p>
<p class="x_xmsonormal">HPE Security Software Engineer</p>
<p class="x_xmsonormal"> </p>
<p class="x_xmsonormal"> </p>
</div>
</div>
</div>
</div>
</body>
</html>