Re: [PATCH] tpm: eventlog: check the payload size before reading tag events

[Jarkko Sakkinen <jarkko@kernel.org>]

On Tue, Nov 03, 2026 at 04:41:55PM +0800, Guanglei Zhu wrote:
> The EVENT_TAG branch of get_event_name() casts the event payload to
> struct tcpa_pc_event and reads from it:
> 
> 	pc_event = (struct tcpa_pc_event *)event_entry;
> 
> 	switch (do_endian_conversion(pc_event->event_id)) {
> 	...
> 		for (i = 0; i < 20; i++)
> 			d_len += sprintf(&data[2*i], "%02x",
> 					pc_event->event_data[i]);
> 
> The log iterators only verify that the event header plus the declared
> event_size stays within the log buffer; they do not require the
> payload of an EVENT_TAG entry to be large enough for the fields the
> branch reads. A truncated entry makes the branch read up to 20 bytes
> of event_data[] past the end of the entry, and, for the last entry in
> the log, past the end of the buffer itself.


What does the spec say about this?

> 
> Skip entries whose payload cannot even hold the event id, and skip
> the 20-byte digest dump when the payload cannot hold the full
> tcpa_pc_event header plus the digest, so the branch never reads
> beyond the entry it is formatting.
> 
> Fixes: 55a82ab3181b ("[PATCH] tpm: add bios measurement log")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guanglei Zhu <zhugl3@xiaopeng.com>
> ---
>  drivers/char/tpm/eventlog/tpm1.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/char/tpm/eventlog/tpm1.c b/drivers/char/tpm/eventlog/tpm1.c
> index 0397e3361020..f93a358a706e 100644
> --- a/drivers/char/tpm/eventlog/tpm1.c
> +++ b/drivers/char/tpm/eventlog/tpm1.c
> @@ -178,6 +178,10 @@ static int get_event_name(char *dest, struct tcpa_event *event,
>  		}
>  		break;
>  	case EVENT_TAG:
> +		if (do_endian_conversion(event->event_size) <
> +		    sizeof(pc_event->event_id))
> +			break;
> +
>  		pc_event = (struct tcpa_pc_event *)event_entry;
>  
>  		/* ToDo Row data -> Base64 */
> @@ -203,6 +207,9 @@ static int get_event_name(char *dest, struct tcpa_event *event,
>  			name = tcpa_pc_event_id_strings[do_endian_conversion
>  							(pc_event->event_id)];
>  			n_len = strlen(name);
> +			if (do_endian_conversion(event->event_size) <
> +			    sizeof(struct tcpa_pc_event) + 20)
> +				break;
>  			for (i = 0; i < 20; i++)
>  				d_len += sprintf(&data[2*i], "%02x",
>  						pc_event->event_data[i]);
> -- 
> 2.50.1
> 

Br, Jarkko