From patchwork Tue Mar 1 23:03:34 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Matthew Garrett X-Patchwork-Id: 597244 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.sourceforge.net (lists.sourceforge.net [216.34.181.88]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 3qP8D61TWtz9ssM for ; Tue, 15 Mar 2016 07:16:54 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=sfs-ml-1.v29.ch3.sourceforge.com) by sfs-ml-1.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1afYv1-0007pJ-3J; Mon, 14 Mar 2016 20:16:47 +0000 Received: from sog-mx-1.v43.ch3.sourceforge.com ([172.29.43.191] helo=mx.sourceforge.net) by sfs-ml-4.v29.ch3.sourceforge.com with esmtp (Exim 4.76) (envelope-from ) id 1aatfZ-0004sI-VD for tpmdd-devel@lists.sourceforge.net; Tue, 01 Mar 2016 23:25:34 +0000 Received-SPF: pass (sog-mx-1.v43.ch3.sourceforge.com: domain of codon.org.uk designates 93.93.128.6 as permitted sender) client-ip=93.93.128.6; envelope-from=prvs=0868d6101d=mjg59@codon.org.uk; helo=cavan.codon.org.uk; Received: from cavan.codon.org.uk ([93.93.128.6]) by sog-mx-1.v43.ch3.sourceforge.com with esmtps (TLSv1:AES128-SHA:128) (Exim 4.76) id 1aatfY-00005h-5R for tpmdd-devel@lists.sourceforge.net; Tue, 01 Mar 2016 23:25:33 +0000 Received: from [2601:645:8000:6df3:3252:cbff:fee6:e579] (helo=xps13-mjg59.libcore.so) by cavan.codon.org.uk with esmtpsa (TLS1.2:DHE_RSA_AES_256_CBC_SHA256:256) (Exim 4.80) (envelope-from ) id 1aatKU-0004o4-6C; Tue, 01 Mar 2016 23:03:48 +0000 From: Matthew Garrett To: peterhuewe@gmx.de Date: Tue, 1 Mar 2016 15:03:34 -0800 Message-Id: <1456873414-6127-1-git-send-email-mjg59@coreos.com> X-Mailer: git-send-email 2.5.0 X-SA-Do-Not-Run: Yes X-SA-Exim-Connect-IP: 2601:645:8000:6df3:3252:cbff:fee6:e579 X-SA-Exim-Mail-From: mjg59@codon.org.uk X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on cavan.codon.org.uk X-Spam-Level: X-Spam-Status: No, score=-1.0 required=5.0 tests=ALL_TRUSTED autolearn=disabled version=3.3.2 X-Spam-ASN: X-SA-Exim-Version: 4.2.1 (built Mon, 26 Dec 2011 16:54:46 +0000) X-SA-Exim-Scanned: Yes (on cavan.codon.org.uk) X-Spam-Score: -1.5 (-) X-Spam-Report: Spam Filtering performed by mx.sourceforge.net. See http://spamassassin.org/tag/ for more details. -1.5 SPF_CHECK_PASS SPF reports sender host as permitted sender for sender-domain -0.0 SPF_HELO_PASS SPF: HELO matches SPF record -0.0 SPF_PASS SPF: sender matches SPF record -0.0 RP_MATCHES_RCVD Envelope sender domain matches handover relay domain 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-Headers-End: 1aatfY-00005h-5R X-Mailman-Approved-At: Mon, 14 Mar 2016 20:16:33 +0000 Cc: tpmdd-devel@lists.sourceforge.net, Matthew Garrett , stable@kernel.org Subject: [tpmdd-devel] [PATCH] Fix unallocated memory access in TPM eventlog code X-BeenThere: tpmdd-devel@lists.sourceforge.net X-Mailman-Version: 2.1.9 Precedence: list List-Id: Tpm Device Driver maintainance List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: tpmdd-devel-bounces@lists.sourceforge.net COmmit 0cc698 added support for handling endian fixups in the event log code but broke the binary log file in the process. Keep the endian code, but read the event data from the actual event rather than from unallocated RAM. Signed-off-by: Matthew Garrett Cc: stable@kernel.org --- Should be applied to 4.4 drivers/char/tpm/tpm_eventlog.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/char/tpm/tpm_eventlog.c b/drivers/char/tpm/tpm_eventlog.c index bd72fb0..e47092c 100644 --- a/drivers/char/tpm/tpm_eventlog.c +++ b/drivers/char/tpm/tpm_eventlog.c @@ -244,7 +244,12 @@ static int tpm_binary_bios_measurements_show(struct seq_file *m, void *v) tempPtr = (char *)&temp_event; - for (i = 0; i < sizeof(struct tcpa_event) + temp_event.event_size; i++) + for (i = 0; i < sizeof(struct tcpa_event); i++) + seq_putc(m, tempPtr[i]); + + tempPtr = (char *)&event->event_data; + + for (i = 0; i < temp_event.event_size; i++) seq_putc(m, tempPtr[i]); return 0;