linux-integrity.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Ard Biesheuvel <ard.biesheuvel@linaro.org>
To: linux-efi@vger.kernel.org, Ingo Molnar <mingo@kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>,
	linux-kernel@vger.kernel.org,
	Ben Dooks <ben.dooks@codethink.co.uk>,
	Dave Young <dyoung@redhat.com>,
	Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>,
	Jerry Snitselaar <jsnitsel@redhat.com>,
	linux-integrity@vger.kernel.org, Lukas Wunner <lukas@wunner.de>,
	Lyude Paul <lyude@redhat.com>, Matthew Garrett <mjg59@google.com>,
	Octavian Purdila <octavian.purdila@intel.com>,
	Peter Jones <pjones@redhat.com>, Scott Talbert <swt@techie.net>
Subject: [PATCH 3/7] efi/tpm: Don't access event->count when it isn't mapped.
Date: Wed,  2 Oct 2019 18:59:00 +0200	[thread overview]
Message-ID: <20191002165904.8819-4-ard.biesheuvel@linaro.org> (raw)
In-Reply-To: <20191002165904.8819-1-ard.biesheuvel@linaro.org>

From: Peter Jones <pjones@redhat.com>

Some machines generate a lot of event log entries.  When we're
iterating over them, the code removes the old mapping and adds a
new one, so once we cross the page boundary we're unmapping the page
with the count on it.  Hilarity ensues.

This patch keeps the info from the header in local variables so we don't
need to access that page again or keep track of if it's mapped.

Fixes: 44038bc514a2 ("tpm: Abstract crypto agile event size calculations")
Cc: linux-efi@vger.kernel.org
Cc: linux-integrity@vger.kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Peter Jones <pjones@redhat.com>
Tested-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Acked-by: Matthew Garrett <mjg59@google.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
---
 include/linux/tpm_eventlog.h | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h
index 63238c84dc0b..12584b69a3f3 100644
--- a/include/linux/tpm_eventlog.h
+++ b/include/linux/tpm_eventlog.h
@@ -170,6 +170,7 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
 	u16 halg;
 	int i;
 	int j;
+	u32 count, event_type;
 
 	marker = event;
 	marker_start = marker;
@@ -190,16 +191,22 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
 	}
 
 	event = (struct tcg_pcr_event2_head *)mapping;
+	/*
+	 * the loop below will unmap these fields if the log is larger than
+	 * one page, so save them here for reference.
+	 */
+	count = READ_ONCE(event->count);
+	event_type = READ_ONCE(event->event_type);
 
 	efispecid = (struct tcg_efi_specid_event_head *)event_header->event;
 
 	/* Check if event is malformed. */
-	if (event->count > efispecid->num_algs) {
+	if (count > efispecid->num_algs) {
 		size = 0;
 		goto out;
 	}
 
-	for (i = 0; i < event->count; i++) {
+	for (i = 0; i < count; i++) {
 		halg_size = sizeof(event->digests[i].alg_id);
 
 		/* Map the digest's algorithm identifier */
@@ -256,8 +263,9 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event,
 		+ event_field->event_size;
 	size = marker - marker_start;
 
-	if ((event->event_type == 0) && (event_field->event_size == 0))
+	if (event_type == 0 && event_field->event_size == 0)
 		size = 0;
+
 out:
 	if (do_mapping)
 		TPM_MEMUNMAP(mapping, mapping_size);
-- 
2.20.1


  parent reply	other threads:[~2019-10-02 17:04 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-10-02 16:58 [GIT PULL 0/7] EFI fixes for v5.4 Ard Biesheuvel
2019-10-02 16:58 ` [PATCH 1/7] efi: cper: Fix endianness of PCIe class code Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi/cper: " tip-bot2 for Lukas Wunner
2019-10-02 16:58 ` [PATCH 2/7] efivar/ssdt: don't iterate over EFI vars if no SSDT override was specified Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efivar/ssdt: Don't " tip-bot2 for Ard Biesheuvel
2019-10-02 16:59 ` Ard Biesheuvel [this message]
2019-10-07 14:49   ` [tip: efi/urgent] efi/tpm: Don't access event->count when it isn't mapped tip-bot2 for Peter Jones
2019-10-02 16:59 ` [PATCH 4/7] efi/tpm: don't traverse an event log with no events Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi/tpm: Don't " tip-bot2 for Peter Jones
2019-10-02 16:59 ` [PATCH 5/7] efi/tpm: only set efi_tpm_final_log_size after successful event log parsing Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi/tpm: Only set 'efi_tpm_final_log_size' " tip-bot2 for Jerry Snitselaar
2019-10-02 16:59 ` [PATCH 6/7] efi: make unexported efi_rci2_sysfs_init static Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi: Make unexported efi_rci2_sysfs_init() static tip-bot2 for Ben Dooks
2019-10-02 16:59 ` [PATCH 7/7] efi/x86: do not clean dummy variable in kexec path Ard Biesheuvel
2019-10-07 14:49   ` [tip: efi/urgent] efi/x86: Do " tip-bot2 for Dave Young

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191002165904.8819-4-ard.biesheuvel@linaro.org \
    --to=ard.biesheuvel@linaro.org \
    --cc=ben.dooks@codethink.co.uk \
    --cc=dyoung@redhat.com \
    --cc=jarkko.sakkinen@linux.intel.com \
    --cc=jsnitsel@redhat.com \
    --cc=linux-efi@vger.kernel.org \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=lukas@wunner.de \
    --cc=lyude@redhat.com \
    --cc=mingo@kernel.org \
    --cc=mjg59@google.com \
    --cc=octavian.purdila@intel.com \
    --cc=pjones@redhat.com \
    --cc=swt@techie.net \
    --cc=tglx@linutronix.de \
    --subject='Re: [PATCH 3/7] efi/tpm: Don'\''t access event->count when it isn'\''t mapped.' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).