tpm: Cap the number of PCR banks-kernel_linux

已合并

tpm: Cap the number of PCR banks #298

张晓亮创建于 3月3日从liang1884/kernel_linux_6.6_8950： cve_6_0_381_456_4 合入到 openharmony/kernel_linux_6.6： OpenHarmony-6.0-Release

tpm: Cap the number of PCR banks #298

已合并

张晓亮创建于 3月3日

从liang1884/kernel_linux_6.6_8950 cve_6_0_381_456_4合入到openharmony/kernel_linux_6.6 OpenHarmony-6.0-Release

共 7 个文件变更+38-15

Mdrivers/char/tpm/tpm-chip.c+3-1

	@@ -279,7 +279,9 @@ static void tpm_dev_release(struct device *dev)
279		279
280	kfree(chip->work_space.context_buf);	280	kfree(chip->work_space.context_buf);
281	kfree(chip->work_space.session_buf);	281	kfree(chip->work_space.session_buf);
282	- kfree(chip->allocated_banks);	282	+#ifdef CONFIG_TCG_TPM2_HMAC
		283	+ kfree(chip->auth);
		284	+#endif
283	kfree(chip);	285	kfree(chip);
284	}	286	}
285		287

Mdrivers/char/tpm/tpm1-cmd.c+0-5

	@@ -799,11 +799,6 @@ int tpm1_pm_suspend(struct tpm_chip *chip, u32 tpm_suspend_pcr)
799	*/	799	*/
800	int tpm1_get_pcr_allocation(struct tpm_chip *chip)	800	int tpm1_get_pcr_allocation(struct tpm_chip *chip)
801	{	801	{
802	- chip->allocated_banks = kcalloc(1, sizeof(*chip->allocated_banks),
803	- GFP_KERNEL);
804	- if (!chip->allocated_banks)
805	- return -ENOMEM;
806	-
807	chip->allocated_banks[0].alg_id = TPM_ALG_SHA1;	802	chip->allocated_banks[0].alg_id = TPM_ALG_SHA1;
808	chip->allocated_banks[0].digest_size = hash_digest_size[HASH_ALGO_SHA1];	803	chip->allocated_banks[0].digest_size = hash_digest_size[HASH_ALGO_SHA1];
809	chip->allocated_banks[0].crypto_id = HASH_ALGO_SHA1;	804	chip->allocated_banks[0].crypto_id = HASH_ALGO_SHA1;

Mdrivers/char/tpm/tpm2-cmd.c+3-5

	@@ -574,11 +574,9 @@ ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
574		574
575	nr_possible_banks = be32_to_cpup(	575	nr_possible_banks = be32_to_cpup(
576	(__be32 *)&buf.data[TPM_HEADER_SIZE + 5]);	576	(__be32 *)&buf.data[TPM_HEADER_SIZE + 5]);
577	-	577	+ if (nr_possible_banks > TPM2_MAX_PCR_BANKS) {
578	- chip->allocated_banks = kcalloc(nr_possible_banks,	578	+ pr_err("tpm: out of bank capacity: %u > %u\n",
579	- sizeof(*chip->allocated_banks),	579	+ nr_possible_banks, TPM2_MAX_PCR_BANKS);
580	- GFP_KERNEL);
581	- if (!chip->allocated_banks) {
582	rc = -ENOMEM;	580	rc = -ENOMEM;
583	goto out;	581	goto out;
584	}	582	}

Mdrivers/usb/gadget/udc/core.c+17-1

	@@ -1118,8 +1118,14 @@ static void usb_gadget_state_work(struct work_struct *work)
1118	void usb_gadget_set_state(struct usb_gadget *gadget,	1118	void usb_gadget_set_state(struct usb_gadget *gadget,
1119	enum usb_device_state state)	1119	enum usb_device_state state)
1120	{	1120	{
		1121	+ unsigned long flags;
		1122	+
		1123	+ spin_lock_irqsave(&gadget->state_lock, flags);
1121	gadget->state = state;	1124	gadget->state = state;
1122	- schedule_work(&gadget->work);	1125	+ if (!gadget->teardown)
		1126	+ schedule_work(&gadget->work);
		1127	+ spin_unlock_irqrestore(&gadget->state_lock, flags);
		1128	+ trace_usb_gadget_set_state(gadget, 0);
1123	}	1129	}
1124	EXPORT_SYMBOL_GPL(usb_gadget_set_state);	1130	EXPORT_SYMBOL_GPL(usb_gadget_set_state);
1125		1131
	@@ -1352,6 +1358,8 @@ static void usb_udc_nop_release(struct device *dev)
1352	void usb_initialize_gadget(struct device parent, struct usb_gadget gadget,	1358	void usb_initialize_gadget(struct device parent, struct usb_gadget gadget,
1353	void (release)(struct device dev))	1359	void (release)(struct device dev))
1354	{	1360	{
		1361	+ spin_lock_init(&gadget->state_lock);
		1362	+ gadget->teardown = false;
1355	INIT_WORK(&gadget->work, usb_gadget_state_work);	1363	INIT_WORK(&gadget->work, usb_gadget_state_work);
1356	gadget->dev.parent = parent;	1364	gadget->dev.parent = parent;
1357		1365
	@@ -1526,6 +1534,7 @@ EXPORT_SYMBOL_GPL(usb_add_gadget_udc);
1526	void usb_del_gadget(struct usb_gadget *gadget)	1534	void usb_del_gadget(struct usb_gadget *gadget)
1527	{	1535	{
1528	struct usb_udc *udc = gadget->udc;	1536	struct usb_udc *udc = gadget->udc;
		1537	+ unsigned long flags;
1529		1538
1530	if (!udc)	1539	if (!udc)
1531	return;	1540	return;
	@@ -1539,6 +1548,13 @@ void usb_del_gadget(struct usb_gadget *gadget)
1539	kobject_uevent(&udc->dev.kobj, KOBJ_REMOVE);	1548	kobject_uevent(&udc->dev.kobj, KOBJ_REMOVE);
1540	sysfs_remove_link(&udc->dev.kobj, "gadget");	1549	sysfs_remove_link(&udc->dev.kobj, "gadget");
1541	device_del(&gadget->dev);	1550	device_del(&gadget->dev);
		1551	+ /*
		1552	+ * Set the teardown flag before flushing the work to prevent new work
		1553	+ * from being scheduled while we are cleaning up.
		1554	+ */
		1555	+ spin_lock_irqsave(&gadget->state_lock, flags);
		1556	+ gadget->teardown = true;
		1557	+ spin_unlock_irqrestore(&gadget->state_lock, flags);
1542	flush_work(&gadget->work);	1558	flush_work(&gadget->work);
1543	ida_free(&gadget_id_numbers, gadget->id_number);	1559	ida_free(&gadget_id_numbers, gadget->id_number);
1544	cancel_work_sync(&udc->vbus_work);	1560	cancel_work_sync(&udc->vbus_work);

Mdrivers/usb/gadget/udc/trace.h+5-0

	@@ -81,6 +81,11 @@ DECLARE_EVENT_CLASS(udc_log_gadget,
81	__entry->ret)	81	__entry->ret)
82	);	82	);
83		83
		84	+DEFINE_EVENT(udc_log_gadget, usb_gadget_set_state,
		85	+ TP_PROTO(struct usb_gadget *g, int ret),
		86	+ TP_ARGS(g, ret)
		87	+);
		88	+
84	DEFINE_EVENT(udc_log_gadget, usb_gadget_frame_number,	89	DEFINE_EVENT(udc_log_gadget, usb_gadget_frame_number,
85	TP_PROTO(struct usb_gadget *g, int ret),	90	TP_PROTO(struct usb_gadget *g, int ret),
86	TP_ARGS(g, ret)	91	TP_ARGS(g, ret)

Minclude/linux/tpm.h+5-3

	@@ -25,7 +25,9 @@
25	#include <crypto/hash_info.h>	25	#include <crypto/hash_info.h>
26		26
27	#define TPM_DIGEST_SIZE 20 /* Max TPM v1.2 PCR size */	27	#define TPM_DIGEST_SIZE 20 /* Max TPM v1.2 PCR size */
28	-#define TPM_MAX_DIGEST_SIZE SHA512_DIGEST_SIZE	28	+
		29	+#define TPM2_MAX_DIGEST_SIZE SHA512_DIGEST_SIZE
		30	+#define TPM2_MAX_PCR_BANKS 8
29		31
30	struct tpm_chip;	32	struct tpm_chip;
31	struct trusted_key_payload;	33	struct trusted_key_payload;
	@@ -51,7 +53,7 @@ enum tpm_algorithms {
51		53
52	struct tpm_digest {	54	struct tpm_digest {
53	u16 alg_id;	55	u16 alg_id;
54	- u8 digest[TPM_MAX_DIGEST_SIZE];	56	+ u8 digest[TPM2_MAX_DIGEST_SIZE];
55	} __packed;	57	} __packed;
56		58
57	struct tpm_bank_info {	59	struct tpm_bank_info {
	@@ -157,7 +159,7 @@ struct tpm_chip {
157	unsigned int groups_cnt;	159	unsigned int groups_cnt;
158		160
159	u32 nr_allocated_banks;	161	u32 nr_allocated_banks;
160	- struct tpm_bank_info *allocated_banks;	162	+ struct tpm_bank_info allocated_banks[TPM2_MAX_PCR_BANKS];
161	#ifdef CONFIG_ACPI	163	#ifdef CONFIG_ACPI
162	acpi_handle acpi_dev_handle;	164	acpi_handle acpi_dev_handle;
163	char ppi_version[TPM_PPI_VERSION_LEN + 1];	165	char ppi_version[TPM_PPI_VERSION_LEN + 1];

Minclude/linux/usb/gadget.h+5-0

	@@ -349,6 +349,9 @@ struct usb_gadget_ops {
349	* can handle. The UDC must support this and all slower speeds and lower	349	* can handle. The UDC must support this and all slower speeds and lower
350	* number of lanes.	350	* number of lanes.
351	* @state: the state we are now (attached, suspended, configured, etc)	351	* @state: the state we are now (attached, suspended, configured, etc)
		352	+ * @state_lock: Spinlock protecting the `state` and `teardown` members.
		353	+ * @teardown: True if the device is undergoing teardown, used to prevent
		354	+ * new work from being scheduled during cleanup.
352	* @name: Identifies the controller hardware type. Used in diagnostics	355	* @name: Identifies the controller hardware type. Used in diagnostics
353	* and sometimes configuration.	356	* and sometimes configuration.
354	* @dev: Driver model state for this abstract device.	357	* @dev: Driver model state for this abstract device.
	@@ -424,6 +427,8 @@ struct usb_gadget {
424	enum usb_ssp_rate max_ssp_rate;	427	enum usb_ssp_rate max_ssp_rate;
425		428
426	enum usb_device_state state;	429	enum usb_device_state state;
		430	+ spinlock_t state_lock;
		431	+ bool teardown;
427	const char *name;	432	const char *name;
428	struct device dev;	433	struct device dev;
429	unsigned isoch_delay;	434	unsigned isoch_delay;