Pull EFI fixes from Ingo Molnar: "Misc EFI fixes all across the map: CPER error report fixes, fixes to TPM event log parsing, fix for a kexec hang, a Sparse fix and other fixes" * 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: efi/tpm: Fix sanity check of unsigned tbl_size being less than zero efi/x86: Do not clean dummy variable in kexec path efi: Make unexported efi_rci2_sysfs_init() static efi/tpm: Only set 'efi_tpm_final_log_size' after successful event log parsing efi/tpm: Don't traverse an event log with no events efi/tpm: Don't access event->count when it isn't mapped efivar/ssdt: Don't iterate over EFI vars if no SSDT override was specified efi/cper: Fix endianness of PCIe class code
Showing the changes to include/linux (1 of 6 files). Show all
Unified · Split
| @@ -152,7 +152,7 @@ struct tcg_algorithm_info { · 151 unmodified lines | ||
| 152 | 152 | * total. Once we've done this we know the offset of the data length field, |
| 153 | 153 | * and can calculate the total size of the event. |
| 154 | 154 | * |
| 155 | − * Return: size of the event on success, <0 on failure | |
| 155 | + * Return: size of the event on success, 0 on failure | |
| 156 | 156 | */ |
| 157 | 157 | |
| 158 | 158 | static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, |
| @@ -170,6 +170,7 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, · 11 unmodified lines | ||
| 170 | 170 | u16 halg; |
| 171 | 171 | int i; |
| 172 | 172 | int j; |
| 173 | + u32 count, event_type; | |
| 173 | 174 | |
| 174 | 175 | marker = event; |
| 175 | 176 | marker_start = marker; |
| @@ -190,16 +191,22 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, · 14 unmodified lines | ||
| 190 | 191 | } |
| 191 | 192 | |
| 192 | 193 | event = (struct tcg_pcr_event2_head *)mapping; |
| 194 | + /* | |
| 195 | + * The loop below will unmap these fields if the log is larger than | |
| 196 | + * one page, so save them here for reference: | |
| 197 | + */ | |
| 198 | + count = READ_ONCE(event->count); | |
| 199 | + event_type = READ_ONCE(event->event_type); | |
| 193 | 200 | |
| 194 | 201 | efispecid = (struct tcg_efi_specid_event_head *)event_header->event; |
| 195 | 202 | |
| 196 | 203 | /* Check if event is malformed. */ |
| 197 | − if (event->count > efispecid->num_algs) { | |
| 204 | + if (count > efispecid->num_algs) { | |
| 198 | 205 | size = 0; |
| 199 | 206 | goto out; |
| 200 | 207 | } |
| 201 | 208 | |
| 202 | − for (i = 0; i < event->count; i++) { | |
| 209 | + for (i = 0; i < count; i++) { | |
| 203 | 210 | halg_size = sizeof(event->digests[i].alg_id); |
| 204 | 211 | |
| 205 | 212 | /* Map the digest's algorithm identifier */ |
| @@ -256,8 +263,9 @@ static inline int __calc_tpm2_event_size(struct tcg_pcr_event2_head *event, · 50 unmodified lines | ||
| 256 | 263 | + event_field->event_size; |
| 257 | 264 | size = marker - marker_start; |
| 258 | 265 | |
| 259 | − if ((event->event_type == 0) && (event_field->event_size == 0)) | |
| 266 | + if (event_type == 0 && event_field->event_size == 0) | |
| 260 | 267 | size = 0; |
| 268 | + | |
| 261 | 269 | out: |
| 262 | 270 | if (do_mapping) |
| 263 | 271 | TPM_MEMUNMAP(mapping, mapping_size); |