On Fri, Aug 30, 2024 at 10:49:46PM +0100, Usama Arif wrote:
>
>
> On 30/08/2024 17:42, Gregory Price wrote:
> > On Fri, Aug 30, 2024 at 10:28:52PM +0100, Usama Arif wrote:
> >> If efi.tpm_log is corrupted, log_tbl->size can be garbage (and
> >> negative). This can result in a large memblock reservation, resulting
> >> in the kernel booting without sufficient memory. Move the memblock
> >> reservation after log_tbl->version check, and check the value of
> >> both tbl_size and memblock_reserve.
> >>
> >> Signed-off-by: Usama Arif <usamaarif642@xxxxxxxxx>
> >> ---
> >> drivers/firmware/efi/tpm.c | 16 +++++++++++++---
> >> 1 file changed, 13 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
> >> index e8d69bd548f3..cfc6a065f441 100644
> >> --- a/drivers/firmware/efi/tpm.c
> >> +++ b/drivers/firmware/efi/tpm.c
> >> @@ -59,9 +59,6 @@ int __init efi_tpm_eventlog_init(void)
> >> return -ENOMEM;
> >> }
> >>
> >> - tbl_size = sizeof(*log_tbl) + log_tbl->size;
> >> - memblock_reserve(efi.tpm_log, tbl_size);
> >> -
> >> if (efi.tpm_final_log == EFI_INVALID_TABLE_ADDR) {
> >> pr_info("TPM Final Events table not present\n");
> >> goto out;
> >
> > The final event table is not present in TCG 1_2 format, but the
> > tpm log still needs to be mapped. So this change is incorrect for
> > v1_2.
>
> hmm so we have
>
> if (efi.tpm_final_log == EFI_INVALID_TABLE_ADDR) {
> pr_info("TPM Final Events table not present\n");
> goto out;
> } else if (log_tbl->version != EFI_TCG2_EVENT_LOG_FORMAT_TCG_2) {
> pr_warn(FW_BUG "TPM Final Events table invalid\n");
> goto out;
> }
>
> If the format is TCG 1_2, then log_tbl is not used?
>
>
if format is tcg 1_2 then log_tbl is used, which is reflected in libstub
drivers/firmware/efi/libstub/tpm.c
efi_guid_t tpm2_guid = EFI_TCG2_PROTOCOL_GUID;
int version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_2;
status = efi_bs_call(locate_protocol, &tpm2_guid, NULL, (void **)&tpm2);
if (status == EFI_SUCCESS) {
status = efi_call_proto(tpm2, get_event_log, version, &log_location,
&log_last_entry, &truncated);
if (status != EFI_SUCCESS || !log_location) {
version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2;
status = efi_call_proto(tpm2, get_event_log, version,
&log_location, &log_last_entry,
&truncated);
^^^^^^^^ log still present in TCG 1_2 ^^^^^^^^^^^
} else {
final_events_table =
get_efi_config_table(EFI_TCG2_FINAL_EVENTS_TABLE_GUID);
}
} else {
~Gregory
