| Message ID | 20190604230433.20936-2-chris.coulson@canonical.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Fix crash in __calc_tpm2_event_size | expand |
On Wed, Jun 05, 2019 at 12:04:33AM +0100, Chris Coulson wrote: > The pointer to the event header is dereferenced on each loop iteration in > order to obtain the digest count, but when called from > tpm2_calc_event_log_size, the event header is unmapped on the first > iteration of the loop. This results in an invalid access for on subsequent > loop iterations for log entries that have more than one digest. > > Signed-off-by: Chris Coulson <chris.coulson@canonical.com> Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> /Jarkko
diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h index 63238c84dc0b..7b76abbff7d8 100644 --- a/include/linux/tpm_eventlog.h +++ b/include/linux/tpm_eventlog.h @@ -165,6 +165,7 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, int mapping_size; void *marker; void *marker_start; + u32 count; u32 halg_size; size_t size; u16 halg; @@ -190,16 +191,17 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, } event = (struct tcg_pcr_event2_head *)mapping; + count = event->count; efispecid = (struct tcg_efi_specid_event_head *)event_header->event; /* Check if event is malformed. */ - if (event->count > efispecid->num_algs) { + if (count > efispecid->num_algs) { size = 0; goto out; } - for (i = 0; i < event->count; i++) { + for (i = 0; i < count; i++) { halg_size = sizeof(event->digests[i].alg_id); /* Map the digest's algorithm identifier */
The pointer to the event header is dereferenced on each loop iteration in order to obtain the digest count, but when called from tpm2_calc_event_log_size, the event header is unmapped on the first iteration of the loop. This results in an invalid access for on subsequent loop iterations for log entries that have more than one digest. Signed-off-by: Chris Coulson <chris.coulson@canonical.com> --- include/linux/tpm_eventlog.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)