linux-kernel - [PATCH 5.3 063/112] efi/tpm: Dont access event->count when it isnt mapped

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20191016214901.201583264@linuxfoundation.org>
Date:   Wed, 16 Oct 2019 14:50:55 -0700
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     linux-kernel@...r.kernel.org
Cc:     Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        stable@...r.kernel.org, Lyude Paul <lyude@...hat.com>,
        Peter Jones <pjones@...hat.com>,
        Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>,
        Ard Biesheuvel <ard.biesheuvel@...aro.org>,
        Matthew Garrett <mjg59@...gle.com>,
        Ben Dooks <ben.dooks@...ethink.co.uk>,
        Dave Young <dyoung@...hat.com>,
        Jerry Snitselaar <jsnitsel@...hat.com>,
        Linus Torvalds <torvalds@...ux-foundation.org>,
        Lukas Wunner <lukas@...ner.de>,
        Octavian Purdila <octavian.purdila@...el.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Scott Talbert <swt@...hie.net>,
        Thomas Gleixner <tglx@...utronix.de>,
        linux-efi@...r.kernel.org, linux-integrity@...r.kernel.org,
        Ingo Molnar <mingo@...nel.org>
Subject: [PATCH 5.3 063/112] efi/tpm: Dont access event->count when it isnt mapped

From: Peter Jones <pjones@...hat.com>

commit 047d50aee341d940350897c85799e56ae57c3849 upstream.

Some machines generate a lot of event log entries.  When we're
iterating over them, the code removes the old mapping and adds a
new one, so once we cross the page boundary we're unmapping the page
with the count on it.  Hilarity ensues.

This patch keeps the info from the header in local variables so we don't
need to access that page again or keep track of if it's mapped.

Tested-by: Lyude Paul <lyude@...hat.com>
Signed-off-by: Peter Jones <pjones@...hat.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@...aro.org>
Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@...ux.intel.com>
Acked-by: Matthew Garrett <mjg59@...gle.com>
Acked-by: Ard Biesheuvel <ard.biesheuvel@...aro.org>
Cc: Ben Dooks <ben.dooks@...ethink.co.uk>
Cc: Dave Young <dyoung@...hat.com>
Cc: Jerry Snitselaar <jsnitsel@...hat.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Lukas Wunner <lukas@...ner.de>
Cc: Octavian Purdila <octavian.purdila@...el.com>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Scott Talbert <swt@...hie.net>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: linux-efi@...r.kernel.org
Cc: linux-integrity@...r.kernel.org
Cc: stable@...r.kernel.org
Fixes: 44038bc514a2 ("tpm: Abstract crypto agile event size calculations")
Link: https://lkml.kernel.org/r/20191002165904.8819-4-ard.biesheuvel@linaro.org
[ Minor edits. ]
Signed-off-by: Ingo Molnar <mingo@...nel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>

---
 include/linux/tpm_eventlog.h |   14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

--- a/include/linux/tpm_eventlog.h
+++ b/include/linux/tpm_eventlog.h
@@ -170,6 +170,7 @@ static inline int __calc_tpm2_event_size
 	u16 halg;
 	int i;
 	int j;
+	u32 count, event_type;

 	marker = event;
 	marker_start = marker;
@@ -190,16 +191,22 @@ static inline int __calc_tpm2_event_size
 	}

 	event = (struct tcg_pcr_event2_head *)mapping;
+	/*
+	 * The loop below will unmap these fields if the log is larger than
+	 * one page, so save them here for reference:
+	 */
+	count = READ_ONCE(event->count);
+	event_type = READ_ONCE(event->event_type);

 	efispecid = (struct tcg_efi_specid_event_head *)event_header->event;

 	/* Check if event is malformed. */
-	if (event->count > efispecid->num_algs) {
+	if (count > efispecid->num_algs) {
 		size = 0;
 		goto out;
 	}

-	for (i = 0; i < event->count; i++) {
+	for (i = 0; i < count; i++) {
 		halg_size = sizeof(event->digests[i].alg_id);

 		/* Map the digest's algorithm identifier */
@@ -256,8 +263,9 @@ static inline int __calc_tpm2_event_size
 		+ event_field->event_size;
 	size = marker - marker_start;

-	if ((event->event_type == 0) && (event_field->event_size == 0))
+	if (event_type == 0 && event_field->event_size == 0)
 		size = 0;
+
 out:
 	if (do_mapping)
 		TPM_MEMUNMAP(mapping, mapping_size);