Re: [PATCH] efi: reserve memory for tpm_log only if TPM final events table is valid

[Gregory Price <gourry@gourry.net>]

On Fri, Aug 30, 2024 at 10:49:46PM +0100, Usama Arif wrote:
> 
> 
> On 30/08/2024 17:42, Gregory Price wrote:
> > On Fri, Aug 30, 2024 at 10:28:52PM +0100, Usama Arif wrote:
> >> If efi.tpm_log is corrupted, log_tbl->size can be garbage (and
> >> negative). This can result in a large memblock reservation, resulting
> >> in the kernel booting without sufficient memory. Move the memblock
> >> reservation after log_tbl->version check, and check the value of
> >> both tbl_size and memblock_reserve.
> >>
> >> Signed-off-by: Usama Arif <usamaarif642@gmail.com>
> >> ---
> >>  drivers/firmware/efi/tpm.c | 16 +++++++++++++---
> >>  1 file changed, 13 insertions(+), 3 deletions(-)
> >>
> >> diff --git a/drivers/firmware/efi/tpm.c b/drivers/firmware/efi/tpm.c
> >> index e8d69bd548f3..cfc6a065f441 100644
> >> --- a/drivers/firmware/efi/tpm.c
> >> +++ b/drivers/firmware/efi/tpm.c
> >> @@ -59,9 +59,6 @@ int __init efi_tpm_eventlog_init(void)
> >>  		return -ENOMEM;
> >>  	}
> >>  
> >> -	tbl_size = sizeof(*log_tbl) + log_tbl->size;
> >> -	memblock_reserve(efi.tpm_log, tbl_size);
> >> -
> >>  	if (efi.tpm_final_log == EFI_INVALID_TABLE_ADDR) {
> >>  		pr_info("TPM Final Events table not present\n");
> >>  		goto out;
> > 
> > The final event table is not present in TCG 1_2 format, but the
> > tpm log still needs to be mapped.  So this change is incorrect for
> > v1_2.
> 
> hmm so we have 
> 
> 	if (efi.tpm_final_log == EFI_INVALID_TABLE_ADDR) {
> 		pr_info("TPM Final Events table not present\n");
> 		goto out;
> 	} else if (log_tbl->version != EFI_TCG2_EVENT_LOG_FORMAT_TCG_2) {
> 		pr_warn(FW_BUG "TPM Final Events table invalid\n");
> 		goto out;
> 	}
> 
> If the format is TCG 1_2, then log_tbl is not used?
> 
> 

if format is tcg 1_2 then log_tbl is used, which is reflected in libstub
drivers/firmware/efi/libstub/tpm.c

        efi_guid_t tpm2_guid = EFI_TCG2_PROTOCOL_GUID;
        int version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_2;

        status = efi_bs_call(locate_protocol, &tpm2_guid, NULL, (void **)&tpm2);
        if (status == EFI_SUCCESS) {
                status = efi_call_proto(tpm2, get_event_log, version, &log_location,
                                        &log_last_entry, &truncated);

                if (status != EFI_SUCCESS || !log_location) {
                        version = EFI_TCG2_EVENT_LOG_FORMAT_TCG_1_2;
                        status = efi_call_proto(tpm2, get_event_log, version,
                                                &log_location, &log_last_entry,
                                                &truncated);
			^^^^^^^^ log still present in TCG 1_2 ^^^^^^^^^^^
                } else {
                        final_events_table =
                                get_efi_config_table(EFI_TCG2_FINAL_EVENTS_TABLE_GUID);
                }
        } else {

~Gregory