linux-kernel - Re: [PATCH] efi: reserve memory for tpm_log only if TPM final events table is valid

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZtI_swMhk04eeYUm@PC2K9PVX.TheFacebook.com>
Date: Fri, 30 Aug 2024 17:54:59 -0400
From: Gregory Price <gourry@...rry.net>
To: Usama Arif <usamaarif642@...il.com>
Cc: ardb@...nel.org, linux-efi@...r.kernel.org,
	linux-kernel@...r.kernel.org, leitao@...ian.org
Subject: Re: [PATCH] efi: reserve memory for tpm_log only if TPM final events
 table is valid

On Fri, Aug 30, 2024 at 10:49:46PM +0100, Usama Arif wrote:
> 
> 
> On 30/08/2024 17:42, Gregory Price wrote:
> > On Fri, Aug 30, 2024 at 10:28:52PM +0100, Usama Arif wrote:
> >> If efi.tpm_log is corrupted, log_tbl->size can be garbage (and
> >> negative). This can result in a large memblock reservation, resulting
> >> in the kernel booting without sufficient memory. Move the memblock
> >> reservation after log_tbl->version check, and check the value of
> >> both tbl_size and memblock_reserve.
> >>
> >> Signed-off-by: Usama Arif <usamaarif642@...il.com>
> >> ---
> >>  drivers/firmware/efi/tpm.c | 16 +++++++++++++---
> >>  1 file changed, 13 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
> >> index e8d69bd548f3..cfc6a065f441 100644
> >> --- a/drivers/firmware/efi/tpm.c
> >> +++ b/drivers/firmware/efi/tpm.c
> >> @@ -59,9 +59,6 @@ int __init efi_tpm_eventlog_init(void)
> >>  		return -ENOMEM;
> >>  	}
> >>  
> >> -	tbl_size = sizeof(*log_tbl) + log_tbl->size;
> >> -	memblock_reserve(efi.tpm_log, tbl_size);
> >> -
> >>  	if (efi.tpm_final_log == EFI_INVALID_TABLE_ADDR) {
> >>  		pr_info("TPM Final Events table not present\n");
> >>  		goto out;
> > 
> > The final event table is not present in TCG 1_2 format, but the
> > tpm log still needs to be mapped.  So this change is incorrect for
> > v1_2.
> 
> hmm so we have 
> 
> 	if (efi.tpm_final_log == EFI_INVALID_TABLE_ADDR) {
> 		pr_info("TPM Final Events table not present\n");
> 		goto out;
> 	} else if (log_tbl->version != EFI_TCG2_EVENT_LOG_FORMAT_TCG_2) {
> 		pr_warn(FW_BUG "TPM Final Events table invalid\n");
> 		goto out;
> 	}
> 
> If the format is TCG 1_2, then log_tbl is not used?
> 
> 

if format is tcg 1_2 then log_tbl is used, which is reflected in libstub
drivers/firmware/efi/libstub/tpm.c

        efi_guid_t tpm2_guid = EFI_TCG2_PROTOCOL_GUID;
        int version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_2;

        status = efi_bs_call(locate_protocol, &tpm2_guid, NULL, (void **)&tpm2);
        if (status == EFI_SUCCESS) {
                status = efi_call_proto(tpm2, get_event_log, version, &log_location,
                                        &log_last_entry, &truncated);

                if (status != EFI_SUCCESS || !log_location) {
                        version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2;
                        status = efi_call_proto(tpm2, get_event_log, version,
                                                &log_location, &log_last_entry,
                                                &truncated);
			^^^^^^^^ log still present in TCG 1_2 ^^^^^^^^^^^
                } else {
                        final_events_table =
                                get_efi_config_table(EFI_TCG2_FINAL_EVENTS_TABLE_GUID);
                }
        } else {

~Gregory