Re: [PATCH] tpm: efi: reject a final events table with an oversized preboot log

[Jarkko Sakkinen]

On Fri, Nov 06, 2026 at 09:49:56AM +0800, Guo Zihao wrote:
> The preboot portion recorded in the main event log is subtracted from
> the size of the final events table taken from the firmware:
> 
> 	/*
> 	 * The 'final events log' size excludes the 'final events preboot log'
> 	 * at its beginning.
> 	 */
> 	final_events_log_size -= log_tbl->final_events_preboot_size;
> 
> Both sizes come from EFI configuration tables and are not validated
> against each other. A final events table claiming a preboot portion
> larger than the table itself makes final_events_log_size go negative:
> the subsequent devm_krealloc() can then end up with a wrapped, too
> small allocation, and the memcpy() that appends the final events log
> uses the negative value as its length, running far past the buffer.
> 
> The boot path has no way to fix up such a table, so fail the final
> events log instead of appending from it.
> 
> Fixes: 166a2809d65b ("tpm: Don't duplicate events from the final event log in the TCG2 log")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>

Ditto.

For all four address validation vs bug fix intersection. I did not
check throughly enough to be exactly sure of all four.

Br, Jarkko