Re: [PATCH 1/1] tpm: ignore duplicate PCR banks in tpm2_get_pcr_allocation

[Jarkko Sakkinen <jarkko@kernel.org>]

On Sat, Sep 19, 2026 at 04:47:00PM +0800, Yuqi Xu wrote:
> The TPM2_CAP_PCRS response is external input and may contain duplicate
> hash algorithms.  tpm2_get_pcr_allocation() adds every active selection
> to allocated_banks, while tpm_sysfs_add_device() has one group slot per
> distinct hash algorithm.  Eight duplicate selections can therefore make
> it write past chip->groups[].
> 
> Keep allocated_banks unique by ignoring duplicate hash algorithms while
> parsing the response.
> 
> Fixes: aab73d952402 ("tpm: add sysfs exports for all banks of PCR registers")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: LLM
> Signed-off-by: Yuqi Xu <xuyuqiabc@gmail.com>
> Reviewed-by: Ren Wei <weir@nebusec.ai>
> ---

It may not contain duplicates as per protocol spec i.e., instead of
silently ignoring the error -EIO should be returned. TPM should not
be enabled if it is compromised.

>  drivers/char/tpm/tpm2-cmd.c | 18 +++++++++++++-----
>  1 file changed, 13 insertions(+), 5 deletions(-)
> 
> diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
> index ae22295df798..99e9d89b18e1 100644
> --- a/drivers/char/tpm/tpm2-cmd.c
> +++ b/drivers/char/tpm/tpm2-cmd.c
> @@ -527,6 +527,7 @@ ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
>  	u32 rsp_len;
>  	int rc;
>  	int i = 0;
> +	int j;
>  
>  	struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
>  	if (!buf)
> @@ -569,13 +570,20 @@ ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
>  		pcr_select_offset = memchr_inv(pcr_selection.pcr_select, 0,
>  					       pcr_selection.size_of_select);
>  		if (pcr_select_offset) {
> -			chip->allocated_banks[nr_alloc_banks].alg_id = hash_alg;
> +			for (j = 0; j < nr_alloc_banks; j++) {
> +				if (chip->allocated_banks[j].alg_id == hash_alg)
> +					break;
> +			}
>  
> -			rc = tpm2_init_bank_info(chip, nr_alloc_banks);
> -			if (rc < 0)
> -				break;
> +			if (j == nr_alloc_banks) {
> +				chip->allocated_banks[nr_alloc_banks].alg_id = hash_alg;
>  
> -			nr_alloc_banks++;
> +				rc = tpm2_init_bank_info(chip, nr_alloc_banks);
> +				if (rc < 0)
> +					break;
> +
> +				nr_alloc_banks++;
> +			}
>  		}
>  
>  		sizeof_pcr_selection = sizeof(pcr_selection.hash_alg) +
> -- 
> 2.55.0
> 

Br, Jarkko