On Fri, Aug 30, 2024 at 10:28:52PM +0100, Usama Arif wrote: > If efi.tpm_log is corrupted, log_tbl->size can be garbage (and > negative). This can result in a large memblock reservation, resulting > in the kernel booting without sufficient memory. Move the memblock > reservation after log_tbl->version check, and check the value of > both tbl_size and memblock_reserve. > > Signed-off-by: Usama Arif <usamaarif642@xxxxxxxxx> > --- > drivers/firmware/efi/tpm.c | 16 +++++++++++++--- > 1 file changed, 13 insertions(+), 3 deletions(-) > > diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c > index e8d69bd548f3..cfc6a065f441 100644 > --- a/drivers/firmware/efi/tpm.c > +++ b/drivers/firmware/efi/tpm.c > @@ -59,9 +59,6 @@ int __init efi_tpm_eventlog_init(void) > return -ENOMEM; > } > > - tbl_size = sizeof(*log_tbl) + log_tbl->size; > - memblock_reserve(efi.tpm_log, tbl_size); > - > if (efi.tpm_final_log == EFI_INVALID_TABLE_ADDR) { > pr_info("TPM Final Events table not present\n"); > goto out; The final event table is not present in TCG 1_2 format, but the tpm log still needs to be mapped. So this change is incorrect for v1_2. > @@ -70,6 +67,19 @@ int __init efi_tpm_eventlog_init(void) > goto out; > } > > + tbl_size = sizeof(*log_tbl) + log_tbl->size; > + if (tbl_size < 0) { > + pr_err(FW_BUG "Failed to parse event in TPM Final Events Log\n"); > + ret = -EINVAL; > + goto out; > + } > + if (memblock_reserve(efi.tpm_log, tbl_size)) { > + pr_err("TPM Event Log memblock reserve fails 0x%lx - %x\n", > + efi.tpm_log, tbl_size); > + ret = -ENOMEM; > + goto out; > + } > + > final_tbl = early_memremap(efi.tpm_final_log, sizeof(*final_tbl)); > > if (!final_tbl) { > -- > 2.43.5 >