mirror of
https://github.com/edk2-porting/linux-next.git
synced 2025-01-15 17:14:00 +08:00
e658c82be5
If __calc_tpm2_event_size() fails to parse an event it will return 0,
resulting tpm2_calc_event_log_size() returning -1. Currently there is
no check of this return value, and 'efi_tpm_final_log_size' can end up
being set to this negative value resulting in a crash like this one:
BUG: unable to handle page fault for address: ffffbc8fc00866ad
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
RIP: 0010:memcpy_erms+0x6/0x10
Call Trace:
tpm_read_log_efi()
tpm_bios_log_setup()
tpm_chip_register()
tpm_tis_core_init.cold.9+0x28c/0x466
tpm_tis_plat_probe()
platform_drv_probe()
...
Also __calc_tpm2_event_size() returns a size of 0 when it fails
to parse an event, so update function documentation to reflect this.
The root cause of the issue that caused the failure of event parsing
in this case is resolved by Peter Jone's patchset dealing with large
event logs where crossing over a page boundary causes the page with
the event count to be unmapped.
Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Ben Dooks <ben.dooks@codethink.co.uk>
Cc: Dave Young <dyoung@redhat.com>
Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Lukas Wunner <lukas@wunner.de>
Cc: Lyude Paul <lyude@redhat.com>
Cc: Matthew Garrett <mjg59@google.com>
Cc: Octavian Purdila <octavian.purdila@intel.com>
Cc: Peter Jones <pjones@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Scott Talbert <swt@techie.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: linux-efi@vger.kernel.org
Cc: linux-integrity@vger.kernel.org
Cc: stable@vger.kernel.org
Fixes: c46f340569
("tpm: Reserve the TPM final events table")
Link: https://lkml.kernel.org/r/20191002165904.8819-6-ard.biesheuvel@linaro.org
Signed-off-by: Ingo Molnar <mingo@kernel.org>
105 lines
2.4 KiB
C
105 lines
2.4 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Copyright (C) 2017 Google, Inc.
|
|
* Thiebaud Weksteen <tweek@google.com>
|
|
*/
|
|
|
|
#define TPM_MEMREMAP(start, size) early_memremap(start, size)
|
|
#define TPM_MEMUNMAP(start, size) early_memunmap(start, size)
|
|
|
|
#include <asm/early_ioremap.h>
|
|
#include <linux/efi.h>
|
|
#include <linux/init.h>
|
|
#include <linux/memblock.h>
|
|
#include <linux/tpm_eventlog.h>
|
|
|
|
int efi_tpm_final_log_size;
|
|
EXPORT_SYMBOL(efi_tpm_final_log_size);
|
|
|
|
static int tpm2_calc_event_log_size(void *data, int count, void *size_info)
|
|
{
|
|
struct tcg_pcr_event2_head *header;
|
|
int event_size, size = 0;
|
|
|
|
while (count > 0) {
|
|
header = data + size;
|
|
event_size = __calc_tpm2_event_size(header, size_info, true);
|
|
if (event_size == 0)
|
|
return -1;
|
|
size += event_size;
|
|
count--;
|
|
}
|
|
|
|
return size;
|
|
}
|
|
|
|
/*
|
|
* Reserve the memory associated with the TPM Event Log configuration table.
|
|
*/
|
|
int __init efi_tpm_eventlog_init(void)
|
|
{
|
|
struct linux_efi_tpm_eventlog *log_tbl;
|
|
struct efi_tcg2_final_events_table *final_tbl;
|
|
unsigned int tbl_size;
|
|
int ret = 0;
|
|
|
|
if (efi.tpm_log == EFI_INVALID_TABLE_ADDR) {
|
|
/*
|
|
* We can't calculate the size of the final events without the
|
|
* first entry in the TPM log, so bail here.
|
|
*/
|
|
return 0;
|
|
}
|
|
|
|
log_tbl = early_memremap(efi.tpm_log, sizeof(*log_tbl));
|
|
if (!log_tbl) {
|
|
pr_err("Failed to map TPM Event Log table @ 0x%lx\n",
|
|
efi.tpm_log);
|
|
efi.tpm_log = EFI_INVALID_TABLE_ADDR;
|
|
return -ENOMEM;
|
|
}
|
|
|
|
tbl_size = sizeof(*log_tbl) + log_tbl->size;
|
|
memblock_reserve(efi.tpm_log, tbl_size);
|
|
|
|
if (efi.tpm_final_log == EFI_INVALID_TABLE_ADDR)
|
|
goto out;
|
|
|
|
final_tbl = early_memremap(efi.tpm_final_log, sizeof(*final_tbl));
|
|
|
|
if (!final_tbl) {
|
|
pr_err("Failed to map TPM Final Event Log table @ 0x%lx\n",
|
|
efi.tpm_final_log);
|
|
efi.tpm_final_log = EFI_INVALID_TABLE_ADDR;
|
|
ret = -ENOMEM;
|
|
goto out;
|
|
}
|
|
|
|
tbl_size = 0;
|
|
if (final_tbl->nr_events != 0) {
|
|
void *events = (void *)efi.tpm_final_log
|
|
+ sizeof(final_tbl->version)
|
|
+ sizeof(final_tbl->nr_events);
|
|
|
|
tbl_size = tpm2_calc_event_log_size(events,
|
|
final_tbl->nr_events,
|
|
log_tbl->log);
|
|
}
|
|
|
|
if (tbl_size < 0) {
|
|
pr_err(FW_BUG "Failed to parse event in TPM Final Events Log\n");
|
|
goto out_calc;
|
|
}
|
|
|
|
memblock_reserve((unsigned long)final_tbl,
|
|
tbl_size + sizeof(*final_tbl));
|
|
efi_tpm_final_log_size = tbl_size;
|
|
|
|
out_calc:
|
|
early_memunmap(final_tbl, sizeof(*final_tbl));
|
|
out:
|
|
early_memunmap(log_tbl, sizeof(*log_tbl));
|
|
return ret;
|
|
}
|
|
|