[PATCH v2] tpm: efi: reject a final events table with an oversized preboot log

[Guo Zihao <guozh23@xiaopeng.com>]

The preboot portion recorded in the main event log is subtracted from
the size of the final events table taken from the firmware:

/*
 * The 'final events log' size excludes the 'final events preboot log'
 * at its beginning.
 */
final_events_log_size -= log_tbl->final_events_preboot_size;

Both sizes come from EFI configuration tables and are not validated
against each other. A final events table claiming a preboot portion
larger than the table itself makes final_events_log_size go negative:
the subsequent devm_krealloc() can then end up with a wrapped, too
small allocation, and the memcpy() that appends the final events log
uses the negative value as its length, running far past the buffer.

The boot path has no way to fix up such a table, so fail the final
events log instead of appending from it. Warn before dropping it, so
a malformed firmware table leaves a trace instead of a silently
missing final events log.

Fixes: 166a2809d65b ("tpm: Don't duplicate events from the final event log in the TCG2 log")
Cc: stable@vger.kernel.org
Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>
---

v2: Add a pr_warn() before dropping the final events log, as suggested
by Ard Biesheuvel, so a malformed firmware table leaves a trace.

 drivers/char/tpm/eventlog/efi.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/char/tpm/eventlog/efi.c b/drivers/char/tpm/eventlog/efi.c
index 4e9d7c2bf32e..76860f9a25de 100644
--- a/drivers/char/tpm/eventlog/efi.c
+++ b/drivers/char/tpm/eventlog/efi.c
@@ -82,6 +82,13 @@ int tpm_read_log_efi(struct tpm_chip *chip)
 		goto out;
 	}
 
+	if (log_tbl->final_events_preboot_size > final_events_log_size) {
+		pr_warn("UEFI TPM final events table has an oversized preboot log: %u > %d\n",
+			log_tbl->final_events_preboot_size,
+			final_events_log_size);
+		goto out;
+	}
+
 	/*
 	 * The 'final events log' size excludes the 'final events preboot log'
 	 * at its beginning.
-- 
2.50.1