From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E952672628; Wed, 3 Dec 2025 02:03:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764727400; cv=none; b=dcharaq6XopRik/2xNIVi9afXjvnkHI59hD3oIq6oAgI8pnvEmMBpYax7Pj0/gHtrZ3s6d3fqktRs02/LaUGR9o9z4iV2bT2IekVKmvnSoZvO9YO2RF1lLPj2rx+3E5MLE5qVD02Fb8odByOuM1RdJF0CvaYAHxLM5s+RI5+UlE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1764727400; c=relaxed/simple; bh=akIASaBEHHO8PzMn1A6nc8DjnlskzlFgVRs3a2LAb7A=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=a1VqhxuG7kgaTT2S6iVzm1d+MjErutJ1xldnsXbSFv+H+uurYQhpvmrSKVoIUXjTlAgCqB6U6ILRg+g80illwmnZq/27+s8EGiX//WkzT2zAWPdmNJ2W2vA+WDhf3aSIyvIqSrbvmSdgTof0wxdC45AMm/dzrLcbfRSCt/72JdE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MKu+DR7G; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MKu+DR7G" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 219C0C4CEF1; Wed, 3 Dec 2025 02:03:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1764727399; bh=akIASaBEHHO8PzMn1A6nc8DjnlskzlFgVRs3a2LAb7A=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=MKu+DR7GtjgrhDZZk7hu7ElkZz5mNCdkII3aah3fccnNqqnYYXA51mee5Hj/005OP WC7ysBO8AkFT6wzN+x/LfUfP+vzhLL+INEVPc53Bwpc3P+FqupR3FcfrRgZ4wXLPTm HrjiorDsp1mTbL2UILyoWJ4srMS9otW80b+XIAvyTxOHSfafIQnkbCqn+XLeMag5Xi rRDMt4lhze+TQGhdoRz0LWghIF5/vuiDeUo9vocbA0wPmEGbveGaT8G84h7MJhQ3Ol Ss0vynOuAQ2Czkhk5LEM3FpEDXI10wC+CcaAdguXacq0bSivLOlvTj7XJnEanEh7pG rJSJsoZA0QQ9Q== Date: Wed, 3 Dec 2025 04:03:15 +0200 From: Jarkko Sakkinen To: "Lai, Yi" Cc: linux-integrity@vger.kernel.org, ross.philipson@oracle.com, Jonathan McDowell , Stefano Garzarella , Jarkko Sakkinen , Roberto Sassu , Jonathan McDowell , Peter Huewe , Jason Gunthorpe , linux-kernel@vger.kernel.org, yi1.lai@intel.com, syzkaller-bugs@googlegroups.com Subject: Re: [PATCH v7 01/11] tpm: Cap the number of PCR banks Message-ID: References: <20251127135445.2141241-1-jarkko@kernel.org> <20251127135445.2141241-2-jarkko@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Wed, Dec 03, 2025 at 09:26:37AM +0800, Lai, Yi wrote: > On Wed, Dec 03, 2025 at 03:11:54AM +0200, Jarkko Sakkinen wrote: > > On Wed, Dec 03, 2025 at 08:57:10AM +0800, Lai, Yi wrote: > > > On Thu, Nov 27, 2025 at 03:54:33PM +0200, Jarkko Sakkinen wrote: > > > > From: Jarkko Sakkinen > > > > > > > > tpm2_get_pcr_allocation() does not cap any upper limit for the number of > > > > banks. Cap the limit to eight banks so that out of bounds values coming > > > > from external I/O cause on only limited harm. > > > > > > > > Cc: Roberto Sassu > > > > Fixes: bcfff8384f6c ("tpm: dynamically allocate the allocated_banks array") > > > > Reviewed-By: Jonathan McDowell > > > > Signed-off-by: Jarkko Sakkinen > > > > --- > > > > v7: > > > > - In Ryzen desktop there is total three banks so yep, eight is probably > > > > much safer bet than four banks. Fixed the commit message as per remark > > > > from Jonathan: > > > > > > > > https://lore.kernel.org/linux-integrity/aPYg1N0TvrkG6AJI@earth.li/#t > > > > > > > > And with that added also reviewed-by. > > > > v6 > > > > - No changes. > > > > v5: > > > > - No changes. > > > > v4: > > > > - Revert spurious changes from include/linux/tpm.h. > > > > - Increase TPM2_MAX_BANKS to 8. > > > > - Rename TPM2_MAX_BANKS as TPM2_MAX_PCR_BANKS for the sake of clarity. > > > > v3: > > > > - Wrote a more clear commit message. > > > > - Fixed pr_err() message. > > > > v2: > > > > - A new patch. > > > > --- > > > > drivers/char/tpm/tpm-chip.c | 13 +++++++++---- > > > > drivers/char/tpm/tpm.h | 1 - > > > > drivers/char/tpm/tpm1-cmd.c | 25 ------------------------- > > > > drivers/char/tpm/tpm2-cmd.c | 8 +++----- > > > > include/linux/tpm.h | 8 +++++--- > > > > 5 files changed, 17 insertions(+), 38 deletions(-) > > > > > > > > diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c > > > > index e25daf2396d3..6cb25862688f 100644 > > > > --- a/drivers/char/tpm/tpm-chip.c > > > > +++ b/drivers/char/tpm/tpm-chip.c > > > > @@ -559,14 +559,19 @@ static int tpm_add_hwrng(struct tpm_chip *chip) > > > > > > > > static int tpm_get_pcr_allocation(struct tpm_chip *chip) > > > > { > > > > - int rc; > > > > + int rc = 0; > > > > > > > > if (tpm_is_firmware_upgrade(chip)) > > > > return 0; > > > > > > > > - rc = (chip->flags & TPM_CHIP_FLAG_TPM2) ? > > > > - tpm2_get_pcr_allocation(chip) : > > > > - tpm1_get_pcr_allocation(chip); > > > > + if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) { > > > > + chip->allocated_banks[0].alg_id = TPM_ALG_SHA1; > > > > + chip->allocated_banks[0].digest_size = hash_digest_size[HASH_ALGO_SHA1]; > > > > + chip->allocated_banks[0].crypto_id = HASH_ALGO_SHA1; > > > > + chip->nr_allocated_banks = 1; > > > > + } else { > > > > + rc = tpm2_get_pcr_allocation(chip); > > > > + } > > > > > > > > if (rc > 0) > > > > return -ENODEV; > > > > diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h > > > > index 2726bd38e5ac..a37712c02e44 100644 > > > > --- a/drivers/char/tpm/tpm.h > > > > +++ b/drivers/char/tpm/tpm.h > > > > @@ -252,7 +252,6 @@ int tpm1_pcr_read(struct tpm_chip *chip, u32 pcr_idx, u8 *res_buf); > > > > ssize_t tpm1_getcap(struct tpm_chip *chip, u32 subcap_id, cap_t *cap, > > > > const char *desc, size_t min_cap_length); > > > > int tpm1_get_random(struct tpm_chip *chip, u8 *out, size_t max); > > > > -int tpm1_get_pcr_allocation(struct tpm_chip *chip); > > > > unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip, u32 ordinal); > > > > int tpm_pm_suspend(struct device *dev); > > > > int tpm_pm_resume(struct device *dev); > > > > diff --git a/drivers/char/tpm/tpm1-cmd.c b/drivers/char/tpm/tpm1-cmd.c > > > > index 11088bda4e68..708bc553437b 100644 > > > > --- a/drivers/char/tpm/tpm1-cmd.c > > > > +++ b/drivers/char/tpm/tpm1-cmd.c > > > > @@ -786,28 +786,3 @@ int tpm1_pm_suspend(struct tpm_chip *chip, u32 tpm_suspend_pcr) > > > > > > > > return rc; > > > > } > > > > - > > > > -/** > > > > - * tpm1_get_pcr_allocation() - initialize the allocated bank > > > > - * @chip: TPM chip to use. > > > > - * > > > > - * The function initializes the SHA1 allocated bank to extend PCR > > > > - * > > > > - * Return: > > > > - * * 0 on success, > > > > - * * < 0 on error. > > > > - */ > > > > -int tpm1_get_pcr_allocation(struct tpm_chip *chip) > > > > -{ > > > > - chip->allocated_banks = kcalloc(1, sizeof(*chip->allocated_banks), > > > > - GFP_KERNEL); > > > > - if (!chip->allocated_banks) > > > > - return -ENOMEM; > > > > - > > > > - chip->allocated_banks[0].alg_id = TPM_ALG_SHA1; > > > > - chip->allocated_banks[0].digest_size = hash_digest_size[HASH_ALGO_SHA1]; > > > > - chip->allocated_banks[0].crypto_id = HASH_ALGO_SHA1; > > > > - chip->nr_allocated_banks = 1; > > > > - > > > > - return 0; > > > > -} > > > > diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c > > > > index 7d77f6fbc152..97501c567c34 100644 > > > > --- a/drivers/char/tpm/tpm2-cmd.c > > > > +++ b/drivers/char/tpm/tpm2-cmd.c > > > > @@ -538,11 +538,9 @@ ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip) > > > > > > > > nr_possible_banks = be32_to_cpup( > > > > (__be32 *)&buf.data[TPM_HEADER_SIZE + 5]); > > > > - > > > > - chip->allocated_banks = kcalloc(nr_possible_banks, > > > > - sizeof(*chip->allocated_banks), > > > > - GFP_KERNEL); > > > > - if (!chip->allocated_banks) { > > > > + if (nr_possible_banks > TPM2_MAX_PCR_BANKS) { > > > > + pr_err("tpm: unexpected number of banks: %u > %u", > > > > + nr_possible_banks, TPM2_MAX_PCR_BANKS); > > > > rc = -ENOMEM; > > > > goto out; > > > > } > > > > diff --git a/include/linux/tpm.h b/include/linux/tpm.h > > > > index dc0338a783f3..eb0ff071bcae 100644 > > > > --- a/include/linux/tpm.h > > > > +++ b/include/linux/tpm.h > > > > @@ -26,7 +26,9 @@ > > > > #include > > > > > > > > #define TPM_DIGEST_SIZE 20 /* Max TPM v1.2 PCR size */ > > > > -#define TPM_MAX_DIGEST_SIZE SHA512_DIGEST_SIZE > > > > + > > > > +#define TPM2_MAX_DIGEST_SIZE SHA512_DIGEST_SIZE > > > > +#define TPM2_MAX_PCR_BANKS 8 > > > > > > > > struct tpm_chip; > > > > struct trusted_key_payload; > > > > @@ -68,7 +70,7 @@ enum tpm2_curves { > > > > > > > > struct tpm_digest { > > > > u16 alg_id; > > > > - u8 digest[TPM_MAX_DIGEST_SIZE]; > > > > + u8 digest[TPM2_MAX_DIGEST_SIZE]; > > > > } __packed; > > > > > > > > struct tpm_bank_info { > > > > @@ -189,7 +191,7 @@ struct tpm_chip { > > > > unsigned int groups_cnt; > > > > > > > > u32 nr_allocated_banks; > > > > - struct tpm_bank_info *allocated_banks; > > > > + struct tpm_bank_info allocated_banks[TPM2_MAX_PCR_BANKS]; > > > > #ifdef CONFIG_ACPI > > > > acpi_handle acpi_dev_handle; > > > > char ppi_version[TPM_PPI_VERSION_LEN + 1]; > > > > -- > > > > 2.52.0 > > > > > > > > > > Hi Jarkko Sakkinen, > > > > > > Greetings! > > > > > > I used Syzkaller and found that there is KASAN: invalid-free in tpm_dev_release in linux-tpmdd branch tpmdd-next-6.19-rc1-v3. > > > > > > After bisection and the first bad commit is: > > > " > > > 83f6ace27d21 tpm: Cap the number of PCR banks > > > > Thank you. I updated the patch in my branch: > > > > https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git/commit/?id=bb731e948843a947b2b7e51552c1387e2c377e03 > > > > Re-test using the latest branch. Issue cannot be reproduced using the > same binary. > > Regards, > Yi Lai Thank you! BR, Jarkko