From patchwork Tue Jun 4 23:04:33 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chris Coulson X-Patchwork-Id: 10976209 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 82DFE1515 for ; Tue, 4 Jun 2019 23:04:50 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 724C828555 for ; Tue, 4 Jun 2019 23:04:50 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 669C8286B1; Tue, 4 Jun 2019 23:04:50 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0022528555 for ; Tue, 4 Jun 2019 23:04:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726179AbfFDXEp (ORCPT ); Tue, 4 Jun 2019 19:04:45 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:36672 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726269AbfFDXEo (ORCPT ); Tue, 4 Jun 2019 19:04:44 -0400 Received: from 95.172.237.253.ip.static.uno.uk.net ([95.172.237.253] helo=localhost.localdomain) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.76) (envelope-from ) id 1hYITz-0006ef-69; Tue, 04 Jun 2019 23:04:43 +0000 From: Chris Coulson To: linux-integrity@vger.kernel.org Cc: Chris Coulson , linux-efi@vger.kernel.org, Peter Huewe , Jarkko Sakkinen , Jason Gunthorpe , Matthew Garrett , Bartosz Szczepanek , Roberto Sassu , Ard Biesheuvel , linux-kernel@vger.kernel.org Subject: [PATCH 1/1] tpm: Don't dereference event after it's unmapped in __calc_tpm2_event_size Date: Wed, 5 Jun 2019 00:04:33 +0100 Message-Id: <20190604230433.20936-2-chris.coulson@canonical.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20190604230433.20936-1-chris.coulson@canonical.com> References: <20190604230433.20936-1-chris.coulson@canonical.com> Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The pointer to the event header is dereferenced on each loop iteration in order to obtain the digest count, but when called from tpm2_calc_event_log_size, the event header is unmapped on the first iteration of the loop. This results in an invalid access for on subsequent loop iterations for log entries that have more than one digest. Signed-off-by: Chris Coulson Reviewed-by: Jarkko Sakkinen --- include/linux/tpm_eventlog.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h index 63238c84dc0b..7b76abbff7d8 100644 --- a/include/linux/tpm_eventlog.h +++ b/include/linux/tpm_eventlog.h @@ -165,6 +165,7 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, int mapping_size; void *marker; void *marker_start; + u32 count; u32 halg_size; size_t size; u16 halg; @@ -190,16 +191,17 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, } event = (struct tcg_pcr_event2_head *)mapping; + count = event->count; efispecid = (struct tcg_efi_specid_event_head *)event_header->event; /* Check if event is malformed. */ - if (event->count > efispecid->num_algs) { + if (count > efispecid->num_algs) { size = 0; goto out; } - for (i = 0; i < event->count; i++) { + for (i = 0; i < count; i++) { halg_size = sizeof(event->digests[i].alg_id); /* Map the digest's algorithm identifier */