From patchwork Wed Oct 2 16:59:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ard Biesheuvel X-Patchwork-Id: 175026 Delivered-To: patch@linaro.org Received: by 2002:a92:7e96:0:0:0:0:0 with SMTP id q22csp1020873ill; Wed, 2 Oct 2019 10:04:21 -0700 (PDT) X-Google-Smtp-Source: APXvYqxvMlAirE4AgaBpQ4m6Do2dref53qve978nvQaKfbfrEgRkxK79RAKg7Uwqcns/gaOcICx3 X-Received: by 2002:a17:906:a44e:: with SMTP id cb14mr3953942ejb.277.1570035861301; Wed, 02 Oct 2019 10:04:21 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1570035861; cv=none; d=google.com; s=arc-20160816; b=tCoZdNEkxHuqcuJCCIPOUxjHHh5zwZ4SATrfu+SiKeY4zhieo13Cmc5tdgMTSZ/X47 xwFu73Mi4ppxTzhzk3OrpXmKiCU1F+C/UF8IJ+GSnoTh4/cMc1a07Db+APSUqevvVrDI LtiuHz5emPh2/HktiaLIwZ5Ykofd3f2X/Ws/M28pxIrrjvLNY5BTF5Sd4dUT65ecSDTa 8v1CcZ/HEtZB4PdLYpnOsLUkvNHAJK+FK11e9BexVTYWwBhub6tLlrjowwgdCHalFiPO 0v1yL5Ff0IHx7FKrlHxkDqnUxy+l9XiGAc2cf1Py+TsimRrAGZS6KOilDF5lWamb73iQ clVg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :dkim-signature; bh=I5173HAo8p1LhYV3fg4+aqN0iEH53Ly0slEkdev9Cjg=; b=ucFvJBSupQAQyCxh9r/UgTfWz0j6AiImatVOrtgTjFpdLRu2Fthkx1/tNbR2g35woC jg/IQs5tcMPdQQrVwxZoNC3owp5cV3y1cFNWDAbO4ZjDmcciEPEnVrLvQ3d85f6UfIv5 lAT0QL8VR4lWTljYbj5joHG/s4xYJ6uvSX1ApyTV7kH3ceteXPBBWh/lavOKzELv+7GC TMF9yaoHrWvpxlb9+4dYt6tGuZENmUyLo32BJGKsRcTHDuzxDeH1K9QerDujMTSHlpkd C1vq4XaQKqjOgSEUlZTypFyiZbLD4UtZFr3wgyYUbZT7FoeR/sxYAXM5nOZNVgz3o8yf ROkw== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=ff5iuJGq; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id e5si11115899ejj.70.2019.10.02.10.04.20; Wed, 02 Oct 2019 10:04:21 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org header.s=google header.b=ff5iuJGq; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728889AbfJBRET (ORCPT + 27 others); Wed, 2 Oct 2019 13:04:19 -0400 Received: from mail-wm1-f66.google.com ([209.85.128.66]:35637 "EHLO mail-wm1-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728612AbfJBRDz (ORCPT ); Wed, 2 Oct 2019 13:03:55 -0400 Received: by mail-wm1-f66.google.com with SMTP id y21so7752390wmi.0 for ; Wed, 02 Oct 2019 10:03:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=I5173HAo8p1LhYV3fg4+aqN0iEH53Ly0slEkdev9Cjg=; b=ff5iuJGqQwK7W8NVggxafmcrET7AQ8KvAtXc439Vhn0YvaoKt3O9eY1Fwk4QhOXb3y b/+lntD2LNGbaNUSQGbZ+9adA2U/h6YUtnqyL3Wl1f5WwwwxSKvZajfn+d+vk6El/F1D B72GlPDKrkfRtJiSH3sKLpJtSzqtM+LOfa8qHZh0wjRAV4UM46VEOVYyBsci5IgRA46a CzstOvEmTXTz8s1hYmNAg+q72lzi62qJjkXoFM59AOpPKif5nn+FfDTXkLuD4e/SzQeA bC19QNkNg3SKzzusUKZwIEu+ws0mJh5XGPzVbDj62+Tb/FrNrgvRLxEVFF7gSUJBuZ1c cX+A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=I5173HAo8p1LhYV3fg4+aqN0iEH53Ly0slEkdev9Cjg=; b=SRPyubbfg4seVEStQNa3U6I6qfLID5ivopvEv1dTcmNB+5zKV/9cR/hmDCsOf3+JlF B+QPnMdlubZ5SbyXJzR9LB7f5b2Kdr+WYUb0UWm03xIfFUN5q0kxWeKOwQbqA1uemTk9 4WboumWqABc766iKsnO8D9DM6ZCNaB5MwFKUAbAHMgNmQhjiLvgT5WdGdSsRxy5zTRhU ePdE7eDLEIgiLJPoQ2Bg3eBi5rgcIjMa+h8VRdtd8vZ+pAoiwbWSWWO2xrTZcy2A5yfw 10eBQZqCr7oIrLaDVrjx+GCZaOM4m2Pblpaf7lHckSR2qhd8a2TmeKvOAbFt0GWPgqeK 7Tgg== X-Gm-Message-State: APjAAAUeQgRJlcZBv3Kdq+SS6KbSRevLctjC5XjLR9DnMZLxqIWJfOm3 KyQE/PrK5xYkzXP0yfrFWJ0vVQ== X-Received: by 2002:a1c:3bd6:: with SMTP id i205mr3561886wma.135.1570035833039; Wed, 02 Oct 2019 10:03:53 -0700 (PDT) Received: from sudo.home ([2a01:cb1d:112:6f00:f145:3252:fc29:76c9]) by smtp.gmail.com with ESMTPSA id f18sm7085459wmh.43.2019.10.02.10.03.51 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Wed, 02 Oct 2019 10:03:52 -0700 (PDT) From: Ard Biesheuvel To: linux-efi@vger.kernel.org, Ingo Molnar , Thomas Gleixner Cc: Ard Biesheuvel , linux-kernel@vger.kernel.org, Ben Dooks , Dave Young , Jarkko Sakkinen , Jerry Snitselaar , linux-integrity@vger.kernel.org, Lukas Wunner , Lyude Paul , Matthew Garrett , Octavian Purdila , Peter Jones , Scott Talbert Subject: [PATCH 3/7] efi/tpm: Don't access event->count when it isn't mapped. Date: Wed, 2 Oct 2019 18:59:00 +0200 Message-Id: <20191002165904.8819-4-ard.biesheuvel@linaro.org> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191002165904.8819-1-ard.biesheuvel@linaro.org> References: <20191002165904.8819-1-ard.biesheuvel@linaro.org> MIME-Version: 1.0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Peter Jones Some machines generate a lot of event log entries. When we're iterating over them, the code removes the old mapping and adds a new one, so once we cross the page boundary we're unmapping the page with the count on it. Hilarity ensues. This patch keeps the info from the header in local variables so we don't need to access that page again or keep track of if it's mapped. Fixes: 44038bc514a2 ("tpm: Abstract crypto agile event size calculations") Cc: linux-efi@vger.kernel.org Cc: linux-integrity@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Peter Jones Tested-by: Lyude Paul Reviewed-by: Jarkko Sakkinen Acked-by: Matthew Garrett Acked-by: Ard Biesheuvel Signed-off-by: Jarkko Sakkinen Signed-off-by: Ard Biesheuvel --- include/linux/tpm_eventlog.h | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) -- 2.20.1 diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h index 63238c84dc0b..12584b69a3f3 100644 --- a/include/linux/tpm_eventlog.h +++ b/include/linux/tpm_eventlog.h @@ -170,6 +170,7 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, u16 halg; int i; int j; + u32 count, event_type; marker = event; marker_start = marker; @@ -190,16 +191,22 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, } event = (struct tcg_pcr_event2_head *)mapping; + /* + * the loop below will unmap these fields if the log is larger than + * one page, so save them here for reference. + */ + count = READ_ONCE(event->count); + event_type = READ_ONCE(event->event_type); efispecid = (struct tcg_efi_specid_event_head *)event_header->event; /* Check if event is malformed. */ - if (event->count > efispecid->num_algs) { + if (count > efispecid->num_algs) { size = 0; goto out; } - for (i = 0; i < event->count; i++) { + for (i = 0; i < count; i++) { halg_size = sizeof(event->digests[i].alg_id); /* Map the digest's algorithm identifier */ @@ -256,8 +263,9 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, + event_field->event_size; size = marker - marker_start; - if ((event->event_type == 0) && (event_field->event_size == 0)) + if (event_type == 0 && event_field->event_size == 0) size = 0; + out: if (do_mapping) TPM_MEMUNMAP(mapping, mapping_size);