linux-integrity.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "tip-bot2 for Peter Jones" <tip-bot2@linutronix.de>
To: linux-tip-commits@vger.kernel.org
Cc: Lyude Paul <lyude@redhat.com>, Peter Jones <pjones@redhat.com>,
	Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>,
	Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	Matthew Garrett <mjg59@google.com>,
	Ben Dooks <ben.dooks@codethink.co.uk>,
	Dave Young <dyoung@redhat.com>,
	Jerry Snitselaar <jsnitsel@redhat.com>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	Lukas Wunner <lukas@wunner.de>,
	Octavian Purdila <octavian.purdila@intel.com>,
	Peter Zijlstra <peterz@infradead.org>,
	Scott Talbert <swt@techie.net>,
	Thomas Gleixner <tglx@linutronix.de>,
	linux-efi@vger.kernel.org, linux-integrity@vger.kernel.org,
	stable@vger.kernel.org, Ingo Molnar <mingo@kernel.org>,
	Borislav Petkov <bp@alien8.de>,
	linux-kernel@vger.kernel.org
Subject: [tip: efi/urgent] efi/tpm: Don't access event->count when it isn't mapped
Date: Mon, 07 Oct 2019 14:49:09 -0000	[thread overview]
Message-ID: <157045974993.9978.18070605431254154051.tip-bot2@tip-bot2> (raw)
In-Reply-To: <20191002165904.8819-4-ard.biesheuvel@linaro.org>

The following commit has been merged into the efi/urgent branch of tip:

Commit-ID:     047d50aee341d940350897c85799e56ae57c3849
Gitweb:        https://git.kernel.org/tip/047d50aee341d940350897c85799e56ae57c3849
Author:        Peter Jones <pjones@redhat.com>
AuthorDate:    Wed, 02 Oct 2019 18:59:00 +02:00
Committer:     Ingo Molnar <mingo@kernel.org>
CommitterDate: Mon, 07 Oct 2019 15:24:35 +02:00

efi/tpm: Don't access event->count when it isn't mapped

Some machines generate a lot of event log entries.  When we're
iterating over them, the code removes the old mapping and adds a
new one, so once we cross the page boundary we're unmapping the page
with the count on it.  Hilarity ensues.

This patch keeps the info from the header in local variables so we don't
need to access that page again or keep track of if it's mapped.

Tested-by: Lyude Paul <lyude@redhat.com>
Signed-off-by: Peter Jones <pjones@redhat.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Acked-by: Matthew Garrett <mjg59@google.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Ben Dooks <ben.dooks@codethink.co.uk>
Cc: Dave Young <dyoung@redhat.com>
Cc: Jerry Snitselaar <jsnitsel@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lukas Wunner <lukas@wunner.de>
Cc: Octavian Purdila <octavian.purdila@intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Scott Talbert <swt@techie.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Cc: linux-integrity@vger.kernel.org
Cc: stable@vger.kernel.org
Fixes: 44038bc514a2 ("tpm: Abstract crypto agile event size calculations")
Link: https://lkml.kernel.org/r/20191002165904.8819-4-ard.biesheuvel@linaro.org
[ Minor edits. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
 include/linux/tpm_eventlog.h | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h
index 63238c8..b50cc3a 100644
--- a/include/linux/tpm_eventlog.h
+++ b/include/linux/tpm_eventlog.h
@@ -170,6 +170,7 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
 	u16 halg;
 	int i;
 	int j;
+	u32 count, event_type;
 
 	marker = event;
 	marker_start = marker;
@@ -190,16 +191,22 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
 	}
 
 	event = (struct tcg_pcr_event2_head *)mapping;
+	/*
+	 * The loop below will unmap these fields if the log is larger than
+	 * one page, so save them here for reference:
+	 */
+	count = READ_ONCE(event->count);
+	event_type = READ_ONCE(event->event_type);
 
 	efispecid = (struct tcg_efi_specid_event_head *)event_header->event;
 
 	/* Check if event is malformed. */
-	if (event->count > efispecid->num_algs) {
+	if (count > efispecid->num_algs) {
 		size = 0;
 		goto out;
 	}
 
-	for (i = 0; i < event->count; i++) {
+	for (i = 0; i < count; i++) {
 		halg_size = sizeof(event->digests[i].alg_id);
 
 		/* Map the digest's algorithm identifier */
@@ -256,8 +263,9 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
 		+ event_field->event_size;
 	size = marker - marker_start;
 
-	if ((event->event_type == 0) && (event_field->event_size == 0))
+	if (event_type == 0 && event_field->event_size == 0)
 		size = 0;
+
 out:
 	if (do_mapping)
 		TPM_MEMUNMAP(mapping, mapping_size);

  reply	other threads:[~2019-10-07 14:51 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-02 16:58 [GIT PULL 0/7] EFI fixes for v5.4 Ard Biesheuvel
2019-10-02 16:58 ` [PATCH 1/7] efi: cper: Fix endianness of PCIe class code Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi/cper: " tip-bot2 for Lukas Wunner
2019-10-02 16:58 ` [PATCH 2/7] efivar/ssdt: don't iterate over EFI vars if no SSDT override was specified Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efivar/ssdt: Don't " tip-bot2 for Ard Biesheuvel
2019-10-02 16:59 ` [PATCH 3/7] efi/tpm: Don't access event->count when it isn't mapped Ard Biesheuvel
2019-10-07 14:49   ` tip-bot2 for Peter Jones [this message]
2019-10-02 16:59 ` [PATCH 4/7] efi/tpm: don't traverse an event log with no events Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi/tpm: Don't " tip-bot2 for Peter Jones
2019-10-02 16:59 ` [PATCH 5/7] efi/tpm: only set efi_tpm_final_log_size after successful event log parsing Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi/tpm: Only set 'efi_tpm_final_log_size' " tip-bot2 for Jerry Snitselaar
2019-10-02 16:59 ` [PATCH 6/7] efi: make unexported efi_rci2_sysfs_init static Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi: Make unexported efi_rci2_sysfs_init() static tip-bot2 for Ben Dooks
2019-10-02 16:59 ` [PATCH 7/7] efi/x86: do not clean dummy variable in kexec path Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi/x86: Do " tip-bot2 for Dave Young

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=157045974993.9978.18070605431254154051.tip-bot2@tip-bot2 \
    --to=tip-bot2@linutronix.de \
    --cc=ard.biesheuvel@linaro.org \
    --cc=ben.dooks@codethink.co.uk \
    --cc=bp@alien8.de \
    --cc=dyoung@redhat.com \
    --cc=jarkko.sakkinen@linux.intel.com \
    --cc=jsnitsel@redhat.com \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-tip-commits@vger.kernel.org \
    --cc=lukas@wunner.de \
    --cc=lyude@redhat.com \
    --cc=mingo@kernel.org \
    --cc=mjg59@google.com \
    --cc=octavian.purdila@intel.com \
    --cc=peterz@infradead.org \
    --cc=pjones@redhat.com \
    --cc=stable@vger.kernel.org \
    --cc=swt@techie.net \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    --subject='Re: [tip: efi/urgent] efi/tpm: Don'\''t access event->count when it isn'\''t mapped' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).