| Message ID | 20200615232504.1848159-1-tyhicks@linux.microsoft.com |
|---|---|
| State | New |
| Headers | show |
| Series | tpm: Require that all digests are present in TCG_PCR_EVENT2 structures | expand |
On Tue, Jun 30, 2020 at 01:33:21PM -0500, Tyler Hicks wrote: > Jarkko, is this an ack from you? > > Is there anything I can do to help along this fix? > > I've spoke with two others that have poured through these specs to > implement firmware event log parsers and they thought the change made > sense. > > Tyler I revisited the original patch and this stroke into my eye: "This is true, for example, when firmware passes the event log to the kernel via a reserved memory region described in device tree." During this discussion you gave an explanation what can trigger the bug but in the commit message nothing anchors to anything. Please give a concrete example what can trigger the issue directly in the commit message instead. It's obviously needed. In addition, you could also rewrite the existing inline comment to be something more reasonable to the context. /Jarkko
On 2020-07-03 02:57:18, Jarkko Sakkinen wrote: > On Tue, Jun 30, 2020 at 01:33:21PM -0500, Tyler Hicks wrote: > > Jarkko, is this an ack from you? > > > > Is there anything I can do to help along this fix? > > > > I've spoke with two others that have poured through these specs to > > implement firmware event log parsers and they thought the change made > > sense. > > > > Tyler > > I revisited the original patch and this stroke into my eye: > > "This is true, for example, when firmware passes the event log to the > kernel via a reserved memory region described in device tree." > > During this discussion you gave an explanation what can trigger the bug > but in the commit message nothing anchors to anything. > > Please give a concrete example what can trigger the issue directly in > the commit message instead. It's obviously needed. > > In addition, you could also rewrite the existing inline comment to be > something more reasonable to the context. These are all fair points and I also see that there's a new conflict with the TPM next branch. I'll rebase the patch on the current next branch, expand on the commit message, and improve the comment in v2. Tyler > > /Jarkko
On Thu, Jul 09, 2020 at 05:58:23PM -0500, Tyler Hicks wrote: > On 2020-07-03 02:57:18, Jarkko Sakkinen wrote: > > On Tue, Jun 30, 2020 at 01:33:21PM -0500, Tyler Hicks wrote: > > > Jarkko, is this an ack from you? > > > > > > Is there anything I can do to help along this fix? > > > > > > I've spoke with two others that have poured through these specs to > > > implement firmware event log parsers and they thought the change made > > > sense. > > > > > > Tyler > > > > I revisited the original patch and this stroke into my eye: > > > > "This is true, for example, when firmware passes the event log to the > > kernel via a reserved memory region described in device tree." > > > > During this discussion you gave an explanation what can trigger the bug > > but in the commit message nothing anchors to anything. > > > > Please give a concrete example what can trigger the issue directly in > > the commit message instead. It's obviously needed. > > > > In addition, you could also rewrite the existing inline comment to be > > something more reasonable to the context. > > These are all fair points and I also see that there's a new conflict > with the TPM next branch. I'll rebase the patch on the current next > branch, expand on the commit message, and improve the comment in v2. > > Tyler Thank you. /Jarkko
diff --git a/include/linux/tpm_eventlog.h b/include/linux/tpm_eventlog.h index 4f8c90c93c29..d83eb9fd5614 100644 --- a/include/linux/tpm_eventlog.h +++ b/include/linux/tpm_eventlog.h @@ -201,7 +201,7 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, efispecid = (struct tcg_efi_specid_event_head *)event_header->event; /* Check if event is malformed. */ - if (count > efispecid->num_algs) { + if (!efispecid->num_algs || count != efispecid->num_algs) { size = 0; goto out; }
Require that the TCG_PCR_EVENT2.digests.count value strictly matches the value of TCG_EfiSpecIdEvent.numberOfAlgorithms in the event field of the TCG_PCClientPCREvent event log header. Also require that TCG_EfiSpecIdEvent.numberOfAlgorithms is non-zero. The TCG PC Client Platform Firmware Profile Specification section 9.1 (Family "2.0", Level 00 Revision 1.04) states: For each Hash algorithm enumerated in the TCG_PCClientPCREvent entry, there SHALL be a corresponding digest in all TCG_PCR_EVENT2 structures. Note: This includes EV_NO_ACTION events which do not extend the PCR. Section 9.4.5.1 provides this description of TCG_EfiSpecIdEvent.numberOfAlgorithms: The number of Hash algorithms in the digestSizes field. This field MUST be set to a value of 0x01 or greater. Enforce these restrictions, as required by the above specification, in order to better identify and ignore invalid sequences of bytes at the end of an otherwise valid TPM2 event log. Firmware doesn't always have the means necessary to inform the kernel of the actual event log size so the kernel's event log parsing code should be stringent when parsing the event log for resiliency against firmware bugs. This is true, for example, when firmware passes the event log to the kernel via a reserved memory region described in device tree. Prior to this patch, a single bit set in the offset corresponding to either the TCG_PCR_EVENT2.eventType or TCG_PCR_EVENT2.eventSize fields, after the last valid event log entry, could confuse the parser into thinking that an additional entry is present in the event log. This patch raises the bar on how difficult it is for stale memory to confuse the kernel's event log parser but there's still a reliance on firmware to properly initialize the remainder of the memory region reserved for the event log as the parser cannot be expected to detect a stale but otherwise properly formatted firmware event log entry. Fixes: fd5c78694f3f ("tpm: fix handling of the TPM 2.0 event logs") Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com> --- include/linux/tpm_eventlog.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)