Commit faf07e61 authored by Jarkko Sakkinen's avatar Jarkko Sakkinen
Browse files

tpm: Cap the number of PCR banks 



tpm2_get_pcr_allocation() does not cap any upper limit for the number of
banks. Cap the limit to eight banks so that out of bounds values coming
from external I/O cause on only limited harm.

Cc: stable@vger.kernel.org # v5.10+
Fixes: bcfff838 ("tpm: dynamically allocate the allocated_banks array")
Tested-by: default avatarLai Yi <yi1.lai@linux.intel.com>
Reviewed-by: default avatarJonathan McDowell <noodles@meta.com>
Reviewed-by: default avatarRoberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: default avatarJarkko Sakkinen <jarkko.sakkinen@opinsys.com>
parent 020a0d8f

drivers/char/tpm/tpm-chip.c

+0 −1
Original line number Diff line number Diff line
@@ -246,7 +246,6 @@ static void tpm_dev_release(struct device *dev) 


	kfree(chip->work_space.context_buf);

	kfree(chip->work_space.session_buf);

	kfree(chip->allocated_banks);

#ifdef CONFIG_TCG_TPM2_HMAC

	kfree(chip->auth);

#endif

drivers/char/tpm/tpm1-cmd.c

+0 −5
Original line number Diff line number Diff line
@@ -799,11 +799,6 @@ int tpm1_pm_suspend(struct tpm_chip *chip, u32 tpm_suspend_pcr) 
 */

int tpm1_get_pcr_allocation(struct tpm_chip *chip)

{

	chip->allocated_banks = kcalloc(1, sizeof(*chip->allocated_banks),

					GFP_KERNEL);

	if (!chip->allocated_banks)

		return -ENOMEM;



	chip->allocated_banks[0].alg_id = TPM_ALG_SHA1;

	chip->allocated_banks[0].digest_size = hash_digest_size[HASH_ALGO_SHA1];

	chip->allocated_banks[0].crypto_id = HASH_ALGO_SHA1;

drivers/char/tpm/tpm2-cmd.c

+3 −5
Original line number Diff line number Diff line
@@ -550,11 +550,9 @@ ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip) 


	nr_possible_banks = be32_to_cpup(

		(__be32 *)&buf.data[TPM_HEADER_SIZE + 5]);



	chip->allocated_banks = kcalloc(nr_possible_banks,

					sizeof(*chip->allocated_banks),

					GFP_KERNEL);

	if (!chip->allocated_banks) {

	if (nr_possible_banks > TPM2_MAX_PCR_BANKS) {

		pr_err("tpm: out of bank capacity: %u > %u\n",

		       nr_possible_banks, TPM2_MAX_PCR_BANKS);

		rc = -ENOMEM;

		goto out;

	}

include/linux/tpm.h

+5 −3
Original line number Diff line number Diff line
@@ -26,7 +26,9 @@ 
#include <crypto/aes.h>



#define TPM_DIGEST_SIZE 20	/* Max TPM v1.2 PCR size */

#define TPM_MAX_DIGEST_SIZE SHA512_DIGEST_SIZE



#define TPM2_MAX_DIGEST_SIZE	SHA512_DIGEST_SIZE

#define TPM2_MAX_PCR_BANKS	8



struct tpm_chip;

struct trusted_key_payload;
@@ -68,7 +70,7 @@ enum tpm2_curves { 


struct tpm_digest {

	u16 alg_id;

	u8 digest[TPM_MAX_DIGEST_SIZE];

	u8 digest[TPM2_MAX_DIGEST_SIZE];

} __packed;



struct tpm_bank_info {
@@ -189,7 +191,7 @@ struct tpm_chip { 
	unsigned int groups_cnt;



	u32 nr_allocated_banks;

	struct tpm_bank_info *allocated_banks;

	struct tpm_bank_info allocated_banks[TPM2_MAX_PCR_BANKS];

#ifdef CONFIG_ACPI

	acpi_handle acpi_dev_handle;

	char ppi_version[TPM_PPI_VERSION_LEN + 1];