From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48C2BC48BDE for ; Sun, 7 Jul 2019 19:44:19 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 2A09E20684 for ; Sun, 7 Jul 2019 19:44:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728399AbfGGToG (ORCPT ); Sun, 7 Jul 2019 15:44:06 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:57346 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727559AbfGGTiJ (ORCPT ); Sun, 7 Jul 2019 15:38:09 -0400 Received: from 94.197.121.43.threembb.co.uk ([94.197.121.43] helo=deadeye) by shadbolt.decadent.org.uk with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.89) (envelope-from ) id 1hkCz6-0006hb-8i; Sun, 07 Jul 2019 20:38:04 +0100 Received: from ben by deadeye with local (Exim 4.92) (envelope-from ) id 1hkCz4-0005bc-QZ; Sun, 07 Jul 2019 20:38:02 +0100 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, Denis Kirjanov , "Jarkko Sakkinen" , "Jia Zhang" Date: Sun, 07 Jul 2019 17:54:17 +0100 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) X-Patchwork-Hint: ignore Subject: [PATCH 3.16 066/129] tpm: Fix off-by-one when reading binary_bios_measurements In-Reply-To: X-SA-Exim-Connect-IP: 94.197.121.43 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.16.70-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Jia Zhang commit 64494d39ff630a63b5308042b20132b491e3706b upstream. It is unable to read the entry when it is the only one in binary_bios_measurements: 00000000 00 00 00 00 08 00 00 00 c4 2f ed ad 26 82 00 cb 00000010 1d 15 f9 78 41 c3 44 e7 9d ae 33 20 00 00 00 00 00000020 This is obviously a firmware problem on my linux machine: Manufacturer: Inspur Product Name: SA5212M4 Version: 01 However, binary_bios_measurements should return it any way, rather than nothing, after all its content is completely valid. Fixes: 55a82ab3181b ("tpm: add bios measurement log") Signed-off-by: Jia Zhang Reviewd-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen [bwh: Backported to 3.16: - Fix an additional comparison in tpm1_bios_measurements_start() - Adjust filename, context] Signed-off-by: Ben Hutchings --- --- a/drivers/char/tpm/tpm_eventlog.c +++ b/drivers/char/tpm/tpm_eventlog.c @@ -81,7 +81,7 @@ static void *tpm_bios_measurements_start for (i = 0; i < *pos; i++) { event = addr; - if ((addr + sizeof(struct tcpa_event)) < limit) { + if ((addr + sizeof(struct tcpa_event)) <= limit) { if (event->event_type == 0 && event->event_size == 0) return NULL; addr += sizeof(struct tcpa_event) + event->event_size; @@ -89,13 +89,13 @@ static void *tpm_bios_measurements_start } /* now check if current entry is valid */ - if ((addr + sizeof(struct tcpa_event)) >= limit) + if ((addr + sizeof(struct tcpa_event)) > limit) return NULL; event = addr; if ((event->event_type == 0 && event->event_size == 0) || - ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit)) + ((addr + sizeof(struct tcpa_event) + event->event_size) > limit)) return NULL; return addr; @@ -111,7 +111,7 @@ static void *tpm_bios_measurements_next( v += sizeof(struct tcpa_event) + event->event_size; /* now check if current entry is valid */ - if ((v + sizeof(struct tcpa_event)) >= limit) + if ((v + sizeof(struct tcpa_event)) > limit) return NULL; event = v; @@ -120,7 +120,7 @@ static void *tpm_bios_measurements_next( return NULL; if ((event->event_type == 0 && event->event_size == 0) || - ((v + sizeof(struct tcpa_event) + event->event_size) >= limit)) + ((v + sizeof(struct tcpa_event) + event->event_size) > limit)) return NULL; (*pos)++;