tpm: Cap the number of PCR banks

[ Upstream commit faf07e611dfa464b201223a7253e9dc5ee0f3c9e ]

tpm2_get_pcr_allocation() does not cap any upper limit for the number of
banks. Cap the limit to eight banks so that out of bounds values coming
from external I/O cause on only limited harm.

Cc: stable@vger.kernel.org # v5.10+
Fixes: bcfff8384f6c ("tpm: dynamically allocate the allocated_banks array")
Tested-by: Lai Yi <yi1.lai@linux.intel.com>
Reviewed-by: Jonathan McDowell <noodles@meta.com>
Reviewed-by: Roberto Sassu <roberto.sassu@huawei.com>
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@opinsys.com>
[ added backward-compatible define for TPM_MAX_DIGEST_SIZE to support older ima_init.c code still using that macro name ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index 1e4f1a5049a55a5a07beeb051c1101507ab68f04..528ed316150ebc71c4c66b987ca9041bb8e12580 100644 (file)
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -269,7 +269,6 @@ static void tpm_dev_release(struct device *dev)
 
        kfree(chip->work_space.context_buf);
        kfree(chip->work_space.session_buf);
-       kfree(chip->allocated_banks);
        kfree(chip);
 }
 

diff --git a/drivers/char/tpm/tpm1-cmd.c b/drivers/char/tpm/tpm1-cmd.c
index ca7158fa6e6cd1c9b0f0e43e542d0d4c73e330f2..28e562843fa5d39d08e601123d41b2d629a3416c 100644 (file)
--- a/drivers/char/tpm/tpm1-cmd.c
+++ b/drivers/char/tpm/tpm1-cmd.c
@@ -794,11 +794,6 @@ int tpm1_pm_suspend(struct tpm_chip *chip, u32 tpm_suspend_pcr)
  */
 int tpm1_get_pcr_allocation(struct tpm_chip *chip)
 {
-       chip->allocated_banks = kcalloc(1, sizeof(*chip->allocated_banks),
-                                       GFP_KERNEL);
-       if (!chip->allocated_banks)
-               return -ENOMEM;
-
        chip->allocated_banks[0].alg_id = TPM_ALG_SHA1;
        chip->allocated_banks[0].digest_size = hash_digest_size[HASH_ALGO_SHA1];
        chip->allocated_banks[0].crypto_id = HASH_ALGO_SHA1;

diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index d0e11d7a3c08b0eec6bf2c852b86bd52009c7025..0b683d991bedf27d07aee55017aaecbe0cb9ab23 100644 (file)
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -574,11 +574,9 @@ ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
 
        nr_possible_banks = be32_to_cpup(
                (__be32 *)&buf.data[TPM_HEADER_SIZE + 5]);
-
-       chip->allocated_banks = kcalloc(nr_possible_banks,
-                                       sizeof(*chip->allocated_banks),
-                                       GFP_KERNEL);
-       if (!chip->allocated_banks) {
+       if (nr_possible_banks > TPM2_MAX_PCR_BANKS) {
+               pr_err("tpm: out of bank capacity: %u > %u\n",
+                      nr_possible_banks, TPM2_MAX_PCR_BANKS);
                rc = -ENOMEM;
                goto out;
        }

diff --git a/include/linux/tpm.h b/include/linux/tpm.h
index 7868e847eee0e317080d5de7ae413e4660a4cb60..6d9d90f01b634c1e6c02264c5089a32701dd0f14 100644 (file)
--- a/include/linux/tpm.h
+++ b/include/linux/tpm.h
@@ -25,7 +25,10 @@
 #include <crypto/hash_info.h>
 
 #define TPM_DIGEST_SIZE 20     /* Max TPM v1.2 PCR size */
-#define TPM_MAX_DIGEST_SIZE SHA512_DIGEST_SIZE
+
+#define TPM2_MAX_DIGEST_SIZE   SHA512_DIGEST_SIZE
+#define TPM2_MAX_PCR_BANKS     8
+#define TPM_MAX_DIGEST_SIZE    TPM2_MAX_DIGEST_SIZE
 
 struct tpm_chip;
 struct trusted_key_payload;
@@ -44,7 +47,7 @@ enum tpm_algorithms {
 
 struct tpm_digest {
        u16 alg_id;
-       u8 digest[TPM_MAX_DIGEST_SIZE];
+       u8 digest[TPM2_MAX_DIGEST_SIZE];
 } __packed;
 
 struct tpm_bank_info {
@@ -150,7 +153,7 @@ struct tpm_chip {
        unsigned int groups_cnt;
 
        u32 nr_allocated_banks;
-       struct tpm_bank_info *allocated_banks;
+       struct tpm_bank_info allocated_banks[TPM2_MAX_PCR_BANKS];
 #ifdef CONFIG_ACPI
        acpi_handle acpi_dev_handle;
        char ppi_version[TPM_PPI_VERSION_LEN + 1];