[PATCH] tpm: efi: reject a final events table with an oversized preboot log

[Guo Zihao]

The preboot portion recorded in the main event log is subtracted from
the size of the final events table taken from the firmware:

	/*
	 * The 'final events log' size excludes the 'final events preboot log'
	 * at its beginning.
	 */
	final_events_log_size -= log_tbl->final_events_preboot_size;

Both sizes come from EFI configuration tables and are not validated
against each other. A final events table claiming a preboot portion
larger than the table itself makes final_events_log_size go negative:
the subsequent devm_krealloc() can then end up with a wrapped, too
small allocation, and the memcpy() that appends the final events log
uses the negative value as its length, running far past the buffer.

The boot path has no way to fix up such a table, so fail the final
events log instead of appending from it.

Fixes: 166a2809d65b ("tpm: Don't duplicate events from the final event log in the TCG2 log")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>
---
 drivers/char/tpm/eventlog/efi.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/char/tpm/eventlog/efi.c b/drivers/char/tpm/eventlog/efi.c
index 4e9d7c2bf..0a8006f3e 100644
--- a/drivers/char/tpm/eventlog/efi.c
+++ b/drivers/char/tpm/eventlog/efi.c
@@ -82,6 +82,9 @@ int tpm_read_log_efi(struct tpm_chip *chip)
 		goto out;
 	}
 
+	if (log_tbl->final_events_preboot_size > final_events_log_size)
+		goto out;
+
 	/*
 	 * The 'final events log' size excludes the 'final events preboot log'
 	 * at its beginning.
-- 
2.50.1