linux-integrity.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "tip-bot2 for Jerry Snitselaar" <tip-bot2@linutronix.de>
To: linux-tip-commits@vger.kernel.org
Cc: Jerry Snitselaar <jsnitsel@redhat.com>,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	Ben Dooks <ben.dooks@codethink.co.uk>,
	Dave Young <dyoung@redhat.com>,
	Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	Lukas Wunner <lukas@wunner.de>, Lyude Paul <lyude@redhat.com>,
	Matthew Garrett <mjg59@google.com>,
	Octavian Purdila <octavian.purdila@intel.com>,
	Peter Jones <pjones@redhat.com>,
	Peter Zijlstra <peterz@infradead.org>,
	Scott Talbert <swt@techie.net>,
	Thomas Gleixner <tglx@linutronix.de>,
	linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org,
	stable@vger.kernel.org, Ingo Molnar <mingo@kernel.org>,
	Borislav Petkov <bp@alien8.de>,
	linux-kernel@vger.kernel.org
Subject: [tip: efi/urgent] efi/tpm: Only set 'efi_tpm_final_log_size' after successful event log parsing
Date: Mon, 07 Oct 2019 14:49:09 -0000	[thread overview]
Message-ID: <157045974966.9978.8246206842413529379.tip-bot2@tip-bot2> (raw)
In-Reply-To: <20191002165904.8819-6-ard.biesheuvel@linaro.org>

The following commit has been merged into the efi/urgent branch of tip:

Commit-ID:     e658c82be5561412c5e83b5e74e9da4830593f3e
Gitweb:        https://git.kernel.org/tip/e658c82be5561412c5e83b5e74e9da4830593f3e
Author:        Jerry Snitselaar <jsnitsel@redhat.com>
AuthorDate:    Wed, 02 Oct 2019 18:59:02 +02:00
Committer:     Ingo Molnar <mingo@kernel.org>
CommitterDate: Mon, 07 Oct 2019 15:24:36 +02:00

efi/tpm: Only set 'efi_tpm_final_log_size' after successful event log parsing

If __calc_tpm2_event_size() fails to parse an event it will return 0,
resulting tpm2_calc_event_log_size() returning -1. Currently there is
no check of this return value, and 'efi_tpm_final_log_size' can end up
being set to this negative value resulting in a crash like this one:

  BUG: unable to handle page fault for address: ffffbc8fc00866ad
  #PF: supervisor read access in kernel mode
  #PF: error_code(0x0000) - not-present page

  RIP: 0010:memcpy_erms+0x6/0x10
  Call Trace:
   tpm_read_log_efi()
   tpm_bios_log_setup()
   tpm_chip_register()
   tpm_tis_core_init.cold.9+0x28c/0x466
   tpm_tis_plat_probe()
   platform_drv_probe()
   ...

Also __calc_tpm2_event_size() returns a size of 0 when it fails
to parse an event, so update function documentation to reflect this.

The root cause of the issue that caused the failure of event parsing
in this case is resolved by Peter Jone's patchset dealing with large
event logs where crossing over a page boundary causes the page with
the event count to be unmapped.

Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Ben Dooks <ben.dooks@codethink.co.uk>
Cc: Dave Young <dyoung@redhat.com>
Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lukas Wunner <lukas@wunner.de>
Cc: Lyude Paul <lyude@redhat.com>
Cc: Matthew Garrett <mjg59@google.com>
Cc: Octavian Purdila <octavian.purdila@intel.com>
Cc: Peter Jones <pjones@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Scott Talbert <swt@techie.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Cc: linux-integrity@vger.kernel.org
Cc: stable@vger.kernel.org
Fixes: c46f3405692de ("tpm: Reserve the TPM final events table")
Link: https://lkml.kernel.org/r/20191002165904.8819-6-ard.biesheuvel@linaro.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 drivers/firmware/efi/tpm.c   |  9 ++++++++-
 include/linux/tpm_eventlog.h |  2 +-
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
index b9ae5c6..703469c 100644
--- a/drivers/firmware/efi/tpm.c
+++ b/drivers/firmware/efi/tpm.c
@@ -85,11 +85,18 @@ int __init efi_tpm_eventlog_init(void)
 						    final_tbl->nr_events,
 						    log_tbl->log);
 	}
+
+	if (tbl_size < 0) {
+		pr_err(FW_BUG "Failed to parse event in TPM Final Events Log\n");
+		goto out_calc;
+	}
+
 	memblock_reserve((unsigned long)final_tbl,
 			 tbl_size + sizeof(*final_tbl));
-	early_memunmap(final_tbl, sizeof(*final_tbl));
 	efi_tpm_final_log_size = tbl_size;
 
+out_calc:
+	early_memunmap(final_tbl, sizeof(*final_tbl));
 out:
 	early_memunmap(log_tbl, sizeof(*log_tbl));
 	return ret;
diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h
index b50cc3a..131ea1b 100644
--- a/include/linux/tpm_eventlog.h
+++ b/include/linux/tpm_eventlog.h
@@ -152,7 +152,7 @@ struct tcg_algorithm_info {
  * total. Once we've done this we know the offset of the data length field,
  * and can calculate the total size of the event.
  *
- * Return: size of the event on success, <0 on failure
+ * Return: size of the event on success, 0 on failure
  */
 
 static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,

  reply	other threads:[~2019-10-07 14:51 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-02 16:58 [GIT PULL 0/7] EFI fixes for v5.4 Ard Biesheuvel
2019-10-02 16:58 ` [PATCH 1/7] efi: cper: Fix endianness of PCIe class code Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi/cper: " tip-bot2 for Lukas Wunner
2019-10-02 16:58 ` [PATCH 2/7] efivar/ssdt: don't iterate over EFI vars if no SSDT override was specified Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efivar/ssdt: Don't " tip-bot2 for Ard Biesheuvel
2019-10-02 16:59 ` [PATCH 3/7] efi/tpm: Don't access event->count when it isn't mapped Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] " tip-bot2 for Peter Jones
2019-10-02 16:59 ` [PATCH 4/7] efi/tpm: don't traverse an event log with no events Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi/tpm: Don't " tip-bot2 for Peter Jones
2019-10-02 16:59 ` [PATCH 5/7] efi/tpm: only set efi_tpm_final_log_size after successful event log parsing Ard Biesheuvel
2019-10-07 14:49   ` tip-bot2 for Jerry Snitselaar [this message]
2019-10-02 16:59 ` [PATCH 6/7] efi: make unexported efi_rci2_sysfs_init static Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi: Make unexported efi_rci2_sysfs_init() static tip-bot2 for Ben Dooks
2019-10-02 16:59 ` [PATCH 7/7] efi/x86: do not clean dummy variable in kexec path Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi/x86: Do " tip-bot2 for Dave Young

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=157045974966.9978.8246206842413529379.tip-bot2@tip-bot2 \
    --to=tip-bot2@linutronix.de \
    --cc=ard.biesheuvel@linaro.org \
    --cc=ben.dooks@codethink.co.uk \
    --cc=bp@alien8.de \
    --cc=dyoung@redhat.com \
    --cc=jarkko.sakkinen@linux.intel.com \
    --cc=jsnitsel@redhat.com \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-tip-commits@vger.kernel.org \
    --cc=lukas@wunner.de \
    --cc=lyude@redhat.com \
    --cc=mingo@kernel.org \
    --cc=mjg59@google.com \
    --cc=octavian.purdila@intel.com \
    --cc=peterz@infradead.org \
    --cc=pjones@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=swt@techie.net \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    --subject='Re: [tip: efi/urgent] efi/tpm: Only set '\''efi_tpm_final_log_size'\'' after successful event log parsing' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).