[tpm2] Re: Tss2_Tcti_Device_Init context not zeroed

Roberts, William C <william.c.roberts at intel.com> Thu, 14 Jul 2022 14:09:44 +0000
Newsgroups dev.linux.lists.tpm2
Message-ID <SN6PR11MB343764654CBF1EFA2C9EC7D2B8889@SN6PR11MB3437.namprd11.prod.outlook.com>
Good sleuthing, I still wonder though, looking at all the tcti code, if a memset 0 is still
worth it in all the init functions to prevent this from happening again. Looking at the rest
of the tcti's they all look fine AFAICT.
________________________________
From: Antonio de Moraes, Marcos <marcos.antonio-de-moraes(a)hpe.com>
Sent: Wednesday, July 13, 2022 4:50 PM
To: Roberts, William C <william.c.roberts(a)intel.com>; tpm2(a)lists.01.org <tpm2(a)lists.01.org>
Subject: RE: Tss2_Tcti_Device_Init context not zeroed


Thanks Willian!



I found that the issue that I reported is already fixed on commit [fda07f78d93a85b7146501b70d8e655d92783fb4] tcti-device: 'partial' may be used uninitialized

<

commit fda07f78d93a85b7146501b70d8e655d92783fb4 (HEAD)

Author: Jeffrey Ferreira jeffpferreira(a)gmail.com<mailto:jeffpferreira(a)gmail.com>

Date:   Tue Mar 30 12:15:01 2021 -0700



    tcti-device: 'partial' may be used uninitialized



    If partial read is not supported then tcti_common->partial will be used

    uninitialized in tcti_device_receive().



    Signed-off-by: Jeffrey Ferreira jeffpferreira(a)gmail.com<mailto:jeffpferreira(a)gmail.com>



diff --git a/src/tss2-tcti/tcti-device.c b/src/tss2-tcti/tcti-device.c

index c606bad1..21a1652f 100644

--- a/src/tss2-tcti/tcti-device.c

+++ b/src/tss2-tcti/tcti-device.c

@@ -412,6 +412,7 @@ Tss2_Tcti_Device_Init (

     tcti_common->state = TCTI_STATE_TRANSMIT;

     memset (&tcti_common->header, 0, sizeof (tcti_common->header));

     tcti_common->locality = 3;

+    tcti_common->partial = false;

     if (conf == NULL) {

         LOG_TRACE ("No TCTI device file specified");

>



Taking the release 3.20 - it has this commit- I built and installed it on my system and now I no longer need to provide a zeroed context memory block to Tss2_Tcti_Device_Init.



Thank you,

Marcos Moraes





From: Roberts, William C <william.c.roberts(a)intel.com>
Sent: terça-feira, 12 de julho de 2022 10:53
To: Antonio de Moraes, Marcos <marcos.antonio-de-moraes(a)hpe.com>; tpm2(a)lists.01.org
Subject: Re: Tss2_Tcti_Device_Init context not zeroed



+ list



> 1 – Is mandatory zeroing it before calling  Tss2_Tcti_Device_Init? If so,  is it a case of missing specification?



No it shouldn't be required IIUC



> 2 – No, it isn’t, so is there a bug?



Looks like a bug and it looks consistent throughout all the init routines for TCTIs.

________________________________

From: Antonio de Moraes, Marcos <marcos.antonio-de-moraes(a)hpe.com<mailto:marcos.antonio-de-moraes(a)hpe.com>>
Sent: Monday, July 11, 2022 1:21 PM
To: tpm2-owner(a)lists.01.org<mailto:tpm2-owner(a)lists.01.org> <tpm2-owner(a)lists.01.org<mailto:tpm2-owner(a)lists.01.org>>
Subject: Tss2_Tcti_Device_Init context not zeroed



Hi all,



  I noticed when performing subsequent tpm2 calls over a not zeroed tcti context  passed to Tss2_Tcti_Device_Init I have errors such as:



“WARNING:tcti:src/tss2-tcti/tcti-device.c:321:tcti_device_receive() TPM2 response size disagrees with number of bytes read from fd 3. Header says 0 but we read 29 bytes.

ERROR:sys:src/tss2-sys/api/Tss2_Sys_Execute.c:118:Tss2_Sys_ExecuteFinish() Malformed response: Invalid tag in response header: 0”



I made some experiments:  If I put some content different than 0x00 at offset 89 in memory block passed to RC Tss2_Tcti_Device_Init it fails. That is also true for some other offsets.







TSS2_RC Tss2_Tcti_Device_Init (TSS2_TCTI_CONTEXT *tctiContext, size_t *size, const char *conf);



I check the description of Tss2_Tcti_Device_Init and didn’t find any observation that tctiContext parameter must point an zeroed memory block, although in the usage examples the allocated memory is zeroed , calling calloc( 1, <needed size>).



Regarding tctiContext memory block passed to Tss2_Tcti_Device_Init:

1 – Is mandatory zeroing it before calling  Tss2_Tcti_Device_Init? If so,  is it a case of missing specification?

2 – No, it isn’t, so is there a bug?



My environment:

TCTI shared library: libtss2-tcti-device.so.0

OS: Enterprise Suse Linux





Thanks in advance,



Marcos A. de Moraes

HPE Security Software Engineer
attachment.htm (text/html, 10.2 KB)
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<style type="text/css" style="display:none;"> P {margin-top:0;margin-bottom:0;} </style>
</head>
<body dir="ltr">
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
Good sleuthing, I still wonder though, looking at all the tcti code, if a memset 0 is still</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
worth it in all the init functions to prevent this from&nbsp;happening again. Looking at the rest</div>
<div style="font-family: Calibri, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);" class="elementToProof">
of the tcti's they all look fine AFAICT.</div>
<div id="appendonsend"></div>
<hr style="display:inline-block;width:98%" tabindex="-1">
<div id="divRplyFwdMsg" dir="ltr"><font face="Calibri, sans-serif" style="font-size:11pt" color="#000000"><b>From:</b> Antonio de Moraes, Marcos &lt;[email protected]&gt;<br>
<b>Sent:</b> Wednesday, July 13, 2022 4:50 PM<br>
<b>To:</b> Roberts, William C &lt;[email protected]&gt;; [email protected] &lt;[email protected]&gt;<br>
<b>Subject:</b> RE: Tss2_Tcti_Device_Init context not zeroed</font>
<div>&nbsp;</div>
</div>
<style>
<!--
@font-face
	{font-family:"Cambria Math"}
@font-face
	{font-family:Calibri}
p.x_MsoNormal, li.x_MsoNormal, div.x_MsoNormal
	{margin:0cm;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif}
a:link, span.x_MsoHyperlink
	{color:#0563C1;
	text-decoration:underline}
p.x_xmsonormal, li.x_xmsonormal, div.x_xmsonormal
	{margin:0cm;
	font-size:11.0pt;
	font-family:"Calibri",sans-serif}
span.x_EmailStyle20
	{font-family:"Calibri",sans-serif;
	color:windowtext}
.x_MsoChpDefault
	{font-size:10.0pt}
@page WordSection1
	{margin:72.0pt 72.0pt 72.0pt 72.0pt}
div.x_WordSection1
	{}
-->
</style>
<div lang="EN-GB" link="#0563C1" vlink="#954F72" style="word-wrap:break-word">
<div class="x_WordSection1">
<p class="x_MsoNormal"><span style="">Thanks Willian!</span></p>
<p class="x_MsoNormal"><span style="">&nbsp;</span></p>
<p class="x_MsoNormal"><span style="">I found that the issue that I reported is already fixed on commit
<b>[fda07f78d93a85b7146501b70d8e655d92783fb4] tcti-device: 'partial' may be used uninitialized</b></span></p>
<p class="x_MsoNormal"><b><span style="">&lt;</span></b><span style="">&nbsp;</span></p>
<p class="x_MsoNormal"><span style="">commit fda07f78d93a85b7146501b70d8e655d92783fb4 (HEAD)</span></p>
<p class="x_MsoNormal"><span style="">Author: Jeffrey Ferreira <a href="mailto:[email protected]">
[email protected]</a></span></p>
<p class="x_MsoNormal"><span style="">Date:&nbsp;&nbsp; Tue Mar 30 12:15:01 2021 -0700</span></p>
<p class="x_MsoNormal"><span style="">&nbsp;</span></p>
<p class="x_MsoNormal"><span style="">&nbsp;&nbsp;&nbsp; tcti-device: 'partial' may be used uninitialized</span></p>
<p class="x_MsoNormal"><span style="">&nbsp;&nbsp;&nbsp; </span></p>
<p class="x_MsoNormal"><span style="">&nbsp;&nbsp;&nbsp;&nbsp;If partial read is not supported then tcti_common-&gt;partial will be used</span></p>
<p class="x_MsoNormal"><span style="">&nbsp;&nbsp;&nbsp; uninitialized in tcti_device_receive().</span></p>
<p class="x_MsoNormal"><span style="">&nbsp;&nbsp;&nbsp; </span></p>
<p class="x_MsoNormal"><span style="">&nbsp;&nbsp;&nbsp;&nbsp;Signed-off-by: Jeffrey Ferreira <a href="mailto:[email protected]">
[email protected]</a></span></p>
<p class="x_MsoNormal"><span style="">&nbsp;</span></p>
<p class="x_MsoNormal"><span style="">diff --git a/src/tss2-tcti/tcti-device.c b/src/tss2-tcti/tcti-device.c</span></p>
<p class="x_MsoNormal"><span style="">index c606bad1..21a1652f 100644</span></p>
<p class="x_MsoNormal"><span style="">--- a/src/tss2-tcti/tcti-device.c</span></p>
<p class="x_MsoNormal"><span style="">+++ b/src/tss2-tcti/tcti-device.c</span></p>
<p class="x_MsoNormal"><span style="">@@ -412,6 +412,7 @@ Tss2_Tcti_Device_Init (</span></p>
<p class="x_MsoNormal"><span style="">&nbsp;&nbsp;&nbsp;&nbsp; tcti_common-&gt;state = TCTI_STATE_TRANSMIT;</span></p>
<p class="x_MsoNormal"><span style="">&nbsp;&nbsp;&nbsp;&nbsp; memset (&amp;tcti_common-&gt;header, 0, sizeof (tcti_common-&gt;header));</span></p>
<p class="x_MsoNormal"><span style="">&nbsp;&nbsp;&nbsp;&nbsp; tcti_common-&gt;locality = 3;</span></p>
<p class="x_MsoNormal"><span style="">+&nbsp;&nbsp;&nbsp; tcti_common-&gt;partial = false;</span></p>
<p class="x_MsoNormal"><span style=""></span></p>
<p class="x_MsoNormal"><span style="">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;if (conf == NULL) {</span></p>
<p class="x_MsoNormal"><span style="">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; LOG_TRACE (&quot;No TCTI device file specified&quot;);</span></p>
<p class="x_MsoNormal"><span style="">&gt;&nbsp;</span></p>
<p class="x_MsoNormal"><span style="">&nbsp;</span></p>
<p class="x_MsoNormal"><span style="">Taking the release 3.20 - it has this commit- I built and installed it on my system and now I no longer need to provide a zeroed context memory block to
</span>Tss2_Tcti_Device_Init.</p>
<p class="x_MsoNormal">&nbsp;</p>
<p class="x_MsoNormal">Thank you,</p>
<p class="x_MsoNormal">Marcos Moraes</p>
<p class="x_MsoNormal"><span style="">&nbsp;</span></p>
<p class="x_MsoNormal"><span style="">&nbsp;</span></p>
<div>
<div style="border:none; border-top:solid #E1E1E1 1.0pt; padding:3.0pt 0cm 0cm 0cm">
<p class="x_MsoNormal"><b><span lang="EN-US">From:</span></b><span lang="EN-US"> Roberts, William C &lt;[email protected]&gt;
<br>
<b>Sent:</b> terça-feira, 12 de julho de 2022 10:53<br>
<b>To:</b> Antonio de Moraes, Marcos &lt;[email protected]&gt;; [email protected]<br>
<b>Subject:</b> Re: Tss2_Tcti_Device_Init context not zeroed</span></p>
</div>
</div>
<p class="x_MsoNormal">&nbsp;</p>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">+ list</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">&nbsp;</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">&gt; 1 – Is mandatory zeroing it before calling &nbsp;Tss2_Tcti_Device_Init? If so, &nbsp;is it a case of missing specification?</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">&nbsp;</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">No it shouldn't be required IIUC</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">&nbsp;</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">&gt; 2 – No, it isn’t, so is there a bug?</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">&nbsp;</span></p>
</div>
<div>
<p class="x_MsoNormal"><span style="font-size:12.0pt; color:black">Looks like a bug and it looks consistent throughout all the init routines for TCTIs.</span></p>
</div>
<div class="x_MsoNormal" align="center" style="text-align:center">
<hr size="2" width="98%" align="center">
</div>
<div id="x_divRplyFwdMsg">
<p class="x_MsoNormal"><b><span style="color:black">From:</span></b><span style="color:black"> Antonio de Moraes, Marcos &lt;</span><a href="mailto:[email protected]">[email protected]</a><span style="color:black">&gt;<br>
<b>Sent:</b> Monday, July 11, 2022 1:21 PM<br>
<b>To:</b> </span><a href="mailto:[email protected]">[email protected]</a><span style="color:black"> &lt;</span><a href="mailto:[email protected]">[email protected]</a><span style="color:black">&gt;<br>
<b>Subject:</b> Tss2_Tcti_Device_Init context not zeroed</span> </p>
<div>
<p class="x_MsoNormal">&nbsp;</p>
</div>
</div>
<div>
<div>
<p class="x_xmsonormal">Hi all,</p>
<p class="x_xmsonormal">&nbsp;</p>
<p class="x_xmsonormal">&nbsp; I noticed when performing subsequent tpm2 calls over a not zeroed tcti context &nbsp;passed to Tss2_Tcti_Device_Init I have errors such as:</p>
<p class="x_xmsonormal">&nbsp;</p>
<p class="x_xmsonormal">“WARNING:tcti:src/tss2-tcti/tcti-device.c:321:tcti_device_receive() TPM2 response size disagrees with number of bytes read from fd 3<b>. Header says 0 but we read 29 bytes</b>.
</p>
<p class="x_xmsonormal">ERROR:sys:src/tss2-sys/api/Tss2_Sys_Execute.c:118:Tss2_Sys_ExecuteFinish() Malformed response: Invalid tag in response header: 0”</p>
<p class="x_xmsonormal">&nbsp;</p>
<p class="x_xmsonormal">I made some experiments: &nbsp;If I put some content different than 0x00 at offset 89 in memory block passed to RC Tss2_Tcti_Device_Init it fails. That is also true for some other offsets.</p>
<p class="x_xmsonormal">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; </p>
<p class="x_xmsonormal">&nbsp;</p>
<p class="x_xmsonormal">&nbsp;</p>
<p class="x_xmsonormal">TSS2_RC Tss2_Tcti_Device_Init (TSS2_TCTI_CONTEXT *tctiContext, size_t *size, const char *conf);</p>
<p class="x_xmsonormal">&nbsp;</p>
<p class="x_xmsonormal">I check the description of Tss2_Tcti_Device_Init and didn’t find any observation that tctiContext parameter must point an zeroed memory block, although in the usage examples the allocated memory is zeroed , calling calloc( 1, &lt;needed
 size&gt;).</p>
<p class="x_xmsonormal">&nbsp;</p>
<p class="x_xmsonormal">Regarding tctiContext memory block passed to Tss2_Tcti_Device_Init:</p>
<p class="x_xmsonormal" style="text-indent:36.0pt">1 – Is mandatory zeroing it before calling &nbsp;Tss2_Tcti_Device_Init? If so, &nbsp;is it a case of missing specification?</p>
<p class="x_xmsonormal" style="text-indent:36.0pt">2 – No, it isn’t, so is there a bug?</p>
<p class="x_xmsonormal" style="text-indent:36.0pt">&nbsp;</p>
<p class="x_xmsonormal">My environment:</p>
<p class="x_xmsonormal" style="text-indent:36.0pt">TCTI shared library: libtss2-tcti-device.so.0</p>
<p class="x_xmsonormal" style="text-indent:36.0pt">OS: Enterprise Suse Linux</p>
<p class="x_xmsonormal">&nbsp;</p>
<p class="x_xmsonormal">&nbsp;</p>
<p class="x_xmsonormal">Thanks in advance,</p>
<p class="x_xmsonormal">&nbsp;</p>
<p class="x_xmsonormal">Marcos A. de Moraes</p>
<p class="x_xmsonormal">HPE Security Software Engineer</p>
<p class="x_xmsonormal">&nbsp;</p>
<p class="x_xmsonormal">&nbsp;</p>
</div>
</div>
</div>
</div>
</body>
</html>