svc: check for overflow when allocating a BigNum buffer

To avoid overflow errors and copy more data than being allocated we must
check for overflow when allocating a buffer for the bignum-buffer whi

svc: check for overflow when allocating a BigNum buffer

To avoid overflow errors and copy more data than being allocated we must
check for overflow when allocating a buffer for the bignum-buffer which
is 8 times larger than the binary buffer.

Fixes: "Integer overflow in crypto system call" as reported by Riscure.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

svc: avoid TOCTOU issue in syscall_hash_final

When checking that the supplied buffer is big enough to fit the computed
digest one should use the local copy 'hlen' instead of 'hash_len' to
prevent th

svc: avoid TOCTOU issue in syscall_hash_final

When checking that the supplied buffer is big enough to fit the computed
digest one should use the local copy 'hlen' instead of 'hash_len' to
prevent that a malicious attacker in REE have changed the size of
'hash_len' after it has been copied to the local buffer.

(TOCTOU: Time Of Check To Time of Use)

Fixes: "Double-fetch of length in syscall_hash_final (x2)" as reported
by Riscure.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

svc: check for allocation overflow in crypto calls part 2

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it migh

svc: check for allocation overflow in crypto calls part 2

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0011: "Integer overflow in crypto system calls (x2)"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

svc: check for allocation overflow in crypto calls

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead

svc: check for allocation overflow in crypto calls

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0010: "Integer overflow in crypto system calls (x2)"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

svc: check for allocation overflow in syscall_cryp_obj_populate

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that i

svc: check for allocation overflow in syscall_cryp_obj_populate

Without checking for overflow there is a risk of allocating a buffer
with size smaller than anticipated and as a consequence of that it might
lead to a heap based overflow with attacker controlled data written
outside the boundaries of the buffer.

Fixes: OP-TEE-2018-0009: "Integer overflow in crypto system calls"

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

fs: prevent out of place write when no data

Fixes: "Uninitialized return value returned if len equals 0" as reported
by Riscure.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by:

fs: prevent out of place write when no data

Fixes: "Uninitialized return value returned if len equals 0" as reported
by Riscure.

Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

rpmb: check return value from essiv call

An error in the function essiv, as for example memory allocation failure
could result in an uninitialized IV, which means that the IV used for
en/decryption

rpmb: check return value from essiv call

An error in the function essiv, as for example memory allocation failure
could result in an uninitialized IV, which means that the IV used for
en/decryption would consist of data previously stored at this memory
location. This could eventually corrupt the filesystem.

Fixes: "Return value of cryptographic function is unchecked" by Riscure.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Tested-by: Joakim Bech <joakim.bech@linaro.org> (QEMU v7, v8)
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Reported-by: Riscure <inforequest@riscure.com>
Reported-by: Alyssa Milburn <a.a.milburn@vu.nl>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: syscall_storage_obj_rename(): fix handling of .rename() return status

Any error returned by fops->rename() should be reflected by
syscall_storage_obj_rename(). There is no reason why errors ot

core: syscall_storage_obj_rename(): fix handling of .rename() return status

Any error returned by fops->rename() should be reflected by
syscall_storage_obj_rename(). There is no reason why errors other than
TEE_ERROR_GENERIC should be ignored.

Fixes the following test case: create two persistent objects (o1 and o2),
close o1, rename o2 to the name of o1. TEE_RenamePersistentObject() should
return TEE_ERROR_ACCESS_CONFLICT, but TEE_SUCCESS is returned instead.

Fixes: https://github.com/OP-TEE/optee_os/issues/2707
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reported-by: Chao Liu <chao.liu@amlogic.com>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove Secure Element API support

There is probably no-one using the Secure Element API. We have never heard
anyone asking questions about it, have no way to test it and we believe
it is not even wo

Remove Secure Element API support

There is probably no-one using the Secure Element API. We have never heard
anyone asking questions about it, have no way to test it and we believe
it is not even working right now. Therefore, remove it.

- The reserved syscalls are still present, but return
TEE_ERROR_NOT_SUPPORTED
- The TEE_SE* functions (GlobalPlatform TEE Secure Element API,
GPD_SPE_024) are removed from libutee.a and the header file
tee_internal_se_api.h is removed as well

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

show more ...

core: crypto: add TEE_ALG_RSASSA_PKCS1_V1_5

This change integrates the LTC_PKCS_1_V1_5_NA1 into OPTEE as an
extension as TEE_ALG_RSASSA_PKCS1_V1_5. This scheme allows to do
PKCS#1 v1.5 EMSA without

core: crypto: add TEE_ALG_RSASSA_PKCS1_V1_5

This change integrates the LTC_PKCS_1_V1_5_NA1 into OPTEE as an
extension as TEE_ALG_RSASSA_PKCS1_V1_5. This scheme allows to do
PKCS#1 v1.5 EMSA without ASN.1 around the hash. It is used for
implementing the pkcs#11 CKM_RSA_PKCS mechanism for signing and
verifying in SKS.

Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Gabor Szekely <szvgabor@gmail.com>

show more ...

core: introduce generic optee_rpc_cmd.h

Replaces the OPTEE_MSG RPC command protocol descriptions in optee_msg.h
and optee_msg_supplicant with a generic optee_rpc_cmd.h. Defined names
are also refact

core: introduce generic optee_rpc_cmd.h

Replaces the OPTEE_MSG RPC command protocol descriptions in optee_msg.h
and optee_msg_supplicant with a generic optee_rpc_cmd.h. Defined names
are also refactored to mirror the new structure.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: tadb.c: get rid of init_memparam()

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wikl

core: tadb.c: get rid of init_memparam()

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: tee_fs_rpc.c get rid of init_memparam()

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens

core: tee_fs_rpc.c get rid of init_memparam()

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: use struct thread_param for RPC

Use struct thread_param as an abstraction of the parameters used for
RPC.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <

core: use struct thread_param for RPC

Use struct thread_param as an abstraction of the parameters used for
RPC.

Acked-by: Etienne Carriere <etienne.carriere@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: simplify shm cookie handling

Simplifies SHM cookie handling by storing the cookie in the mobj instead
of putting the burden on the caller. The cookie parameter is dropped
from the thread_rpc_*

core: simplify shm cookie handling

Simplifies SHM cookie handling by storing the cookie in the mobj instead
of putting the burden on the caller. The cookie parameter is dropped
from the thread_rpc_*_payload() functions. All callers of those
functions are also updated and unused cookie members of related structs
are removed too.

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: modify tee_otp_get_hw_unique_key to return TEE_Result

Getting the hardware key can fail on some platforms. Modify the function
signature to return an appropriate error code.

Signed-off-by: Da

core: modify tee_otp_get_hw_unique_key to return TEE_Result

Getting the hardware key can fail on some platforms. Modify the function
signature to return an appropriate error code.

Signed-off-by: Daniel McIlvaney <damcilva@microsoft.com>
Signed-off-by: Jordan Rhee <jordanrh@microsoft.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix tee_tadb_ta_create() panic

Fixes a panic triggered in tee_tadb_ta_create(). Before this patch
tee_tadb_ta_create() was calling tadb_put() if tee_tadb_open() failed.
This is incorrect as th

core: fix tee_tadb_ta_create() panic

Fixes a panic triggered in tee_tadb_ta_create(). Before this patch
tee_tadb_ta_create() was calling tadb_put() if tee_tadb_open() failed.
This is incorrect as the reference counter hasn't been increased then.
This patch fixes that by only calling tadb_put() once tee_tadb_open()
has succeeded.

Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: tee: crypt_utl: remove one crypto_init

Crypto_init is called twice in tee_cryp_init.

Signed-off-by: Silvano di Ninno <silvano.dininno@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@

core: tee: crypt_utl: remove one crypto_init

Crypto_init is called twice in tee_cryp_init.

Signed-off-by: Silvano di Ninno <silvano.dininno@nxp.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

show more ...

core: tee: update objectSize/keySize for ECDSA/ECDH Objects

objectSize/keySize was not getting updated when an ECDSA/ECDH
object was imported.
Updating the ObjectSize/keySize based on the EC Curve.

core: tee: update objectSize/keySize for ECDSA/ECDH Objects

objectSize/keySize was not getting updated when an ECDSA/ECDH
object was imported.
Updating the ObjectSize/keySize based on the EC Curve.

Fixes: https://github.com/OP-TEE/optee_os/issues/2386
Signed-off-by: Sahil Malhotra <sahil.malhotra@nxp.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove get_rng_array()

Removes get_rng_array() in favor of crypto_rng_read() which always uses
the configured RNG implementation to draw random.

Reviewed-by: Jerome Forissier <jerome.forissier@lina

Remove get_rng_array()

Removes get_rng_array() in favor of crypto_rng_read() which always uses
the configured RNG implementation to draw random.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: add new RNG implementation

Adds a new cryptographically secure pseudo random number generator known
as Fortuna. The implementation is based on the description in [0]. This
implementation repla

core: add new RNG implementation

Adds a new cryptographically secure pseudo random number generator known
as Fortuna. The implementation is based on the description in [0]. This
implementation replaces the implementation in LTC which was used until
now.

Gathering of entropy has been refined with crypto_rng_add_event() to
better match how entropy is added to Fortuna. A enum crypto_rng_src
identifies the source of the event. The source also controls how the
event is added. There are two options available, queue it in a circular
buffer for later processing or adding it directly to a pool. The former
option is suitable when being called from an interrupt handler or some
other place where RPC to normal world is forbidden.

plat_prng_add_jitter_entropy_norpc() is removed and
plat_prng_add_jitter_entropy() is updated to use this new entropy source
scheme.

The configuration of LTC is simplified by this, now PRNG is always drawn
via prng_mpa_desc.

plat_rng_init() takes care of initializing the PRNG in order to allow
platforms to override or enhance the Fortuna integration.

[0] Link:https://www.schneier.com/academic/paperfiles/fortuna.pdf

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: fix syscall_cryp_obj_get_attr() with null buffer

Prior to this patch when syscall_cryp_obj_get_attr() is called with a
NULL buffer to query buffer size the function returns
TEE_ERROR_ACCESS_DE

core: fix syscall_cryp_obj_get_attr() with null buffer

Prior to this patch when syscall_cryp_obj_get_attr() is called with a
NULL buffer to query buffer size the function returns
TEE_ERROR_ACCESS_DENIED while TEE_ERROR_SHORT_BUFFER is expected. This
patch fixes syscall_cryp_obj_get_attr() to return TEE_ERROR_SHORT_BUFFER
if supplied buffer parameter is NULL.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

tee_ree_fs: avoid race condition between fh usage/closing

It is possible that one core will call ree_fs_close_primitive()
while another is calling ree_fs_read_primitive(). This patch
prevents this b

tee_ree_fs: avoid race condition between fh usage/closing

It is possible that one core will call ree_fs_close_primitive()
while another is calling ree_fs_read_primitive(). This patch
prevents this by putting ree_fs_close_primitive under mutex.

Signed-off-by: Volodymyr Babchuk <vlad.babchuk@gmail.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

core: htree: fix meta inclusion in root hash

Prior to this patch was the size of the meta data supplied as the size
of the pointer to meta data. With this patch the size is corrected to be
the size

core: htree: fix meta inclusion in root hash

Prior to this patch was the size of the meta data supplied as the size
of the pointer to meta data. With this patch the size is corrected to be
the size of meta data itself.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Fixes: https://github.com/OP-TEE/optee_os/issues/2330
Fixes: 94a72998bc1d ("core: fs_htree: include meta in root hash")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...

Remove license notice from STMicroelectronics files

Since a while the source files license info are defined by SPDX
identifiers. We can safely remove the verbose license text from the
files that are

Remove license notice from STMicroelectronics files

Since a while the source files license info are defined by SPDX
identifiers. We can safely remove the verbose license text from the
files that are owned by either only STMicroelectronics or only both
Linaro and STMicroelectronics.

Signed-off-by: Etienne Carriere <etienne.carriere@st.com>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>

show more ...