Skip to content

Commit c445ff0

Browse files
committed
patches/coreboot-*: fix tpm1 cbmem crash on 'cbmem -L'
repro: git fetch https://review.coreboot.org/coreboot refs/changes/27/84927/1 && git format-patch -1 --stdout FETCH_HEAD > patches/coreboot-24.02.01/0004-cbmem_tpm-clear_whole_log_on_creation.patch Then copy patch around in forks patch dirs Signed-off-by: Thierry Laurion <insurgo@riseup.net>
1 parent bbb96fd commit c445ff0

3 files changed

Lines changed: 111 additions & 0 deletions

File tree

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
From b83a7607203d285b76e94ffd2013c55b184f5d42 Mon Sep 17 00:00:00 2001
2+
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
3+
Date: Wed, 30 Oct 2024 10:50:37 +0100
4+
Subject: [PATCH] security/tpm/tspi/log-tpm1.c: Clear whole log area on
5+
creation
6+
MIME-Version: 1.0
7+
Content-Type: text/plain; charset=UTF-8
8+
Content-Transfer-Encoding: 8bit
9+
10+
The log area was not entirely cleared on creation resulting in
11+
garbage after the last valid lgo entry. It caused the cbmem utility
12+
to parse invalid events and access data outside the log area.
13+
In the TPM2 log sources, the entire area is being cleared, thus the
14+
issue has not been observed.
15+
16+
Change-Id: I7c780b62b1c6507e1dd1806b20b0270e364cde3d
17+
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
18+
---
19+
src/security/tpm/tspi/log-tpm1.c | 2 +-
20+
1 file changed, 1 insertion(+), 1 deletion(-)
21+
22+
diff --git a/src/security/tpm/tspi/log-tpm1.c b/src/security/tpm/tspi/log-tpm1.c
23+
index 481b569cd5..453e74b4e8 100644
24+
--- a/src/security/tpm/tspi/log-tpm1.c
25+
+++ b/src/security/tpm/tspi/log-tpm1.c
26+
@@ -33,7 +33,7 @@ void *tpm1_log_cbmem_init(void)
27+
if (!tclt)
28+
return NULL;
29+
30+
- memset(tclt, 0, sizeof(*tclt));
31+
+ memset(tclt, 0, tpm_log_len);
32+
hdr = &tclt->spec_id;
33+
34+
/* Fill in first "header" entry. */
35+
--
36+
2.39.5
37+
Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
From b83a7607203d285b76e94ffd2013c55b184f5d42 Mon Sep 17 00:00:00 2001
2+
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
3+
Date: Wed, 30 Oct 2024 10:50:37 +0100
4+
Subject: [PATCH] security/tpm/tspi/log-tpm1.c: Clear whole log area on
5+
creation
6+
MIME-Version: 1.0
7+
Content-Type: text/plain; charset=UTF-8
8+
Content-Transfer-Encoding: 8bit
9+
10+
The log area was not entirely cleared on creation resulting in
11+
garbage after the last valid lgo entry. It caused the cbmem utility
12+
to parse invalid events and access data outside the log area.
13+
In the TPM2 log sources, the entire area is being cleared, thus the
14+
issue has not been observed.
15+
16+
Change-Id: I7c780b62b1c6507e1dd1806b20b0270e364cde3d
17+
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
18+
---
19+
src/security/tpm/tspi/log-tpm1.c | 2 +-
20+
1 file changed, 1 insertion(+), 1 deletion(-)
21+
22+
diff --git a/src/security/tpm/tspi/log-tpm1.c b/src/security/tpm/tspi/log-tpm1.c
23+
index 481b569cd5..453e74b4e8 100644
24+
--- a/src/security/tpm/tspi/log-tpm1.c
25+
+++ b/src/security/tpm/tspi/log-tpm1.c
26+
@@ -33,7 +33,7 @@ void *tpm1_log_cbmem_init(void)
27+
if (!tclt)
28+
return NULL;
29+
30+
- memset(tclt, 0, sizeof(*tclt));
31+
+ memset(tclt, 0, tpm_log_len);
32+
hdr = &tclt->spec_id;
33+
34+
/* Fill in first "header" entry. */
35+
--
36+
2.39.5
37+
Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
From b83a7607203d285b76e94ffd2013c55b184f5d42 Mon Sep 17 00:00:00 2001
2+
From: =?UTF-8?q?Micha=C5=82=20=C5=BBygowski?= <michal.zygowski@3mdeb.com>
3+
Date: Wed, 30 Oct 2024 10:50:37 +0100
4+
Subject: [PATCH] security/tpm/tspi/log-tpm1.c: Clear whole log area on
5+
creation
6+
MIME-Version: 1.0
7+
Content-Type: text/plain; charset=UTF-8
8+
Content-Transfer-Encoding: 8bit
9+
10+
The log area was not entirely cleared on creation resulting in
11+
garbage after the last valid lgo entry. It caused the cbmem utility
12+
to parse invalid events and access data outside the log area.
13+
In the TPM2 log sources, the entire area is being cleared, thus the
14+
issue has not been observed.
15+
16+
Change-Id: I7c780b62b1c6507e1dd1806b20b0270e364cde3d
17+
Signed-off-by: Michał Żygowski <michal.zygowski@3mdeb.com>
18+
---
19+
src/security/tpm/tspi/log-tpm1.c | 2 +-
20+
1 file changed, 1 insertion(+), 1 deletion(-)
21+
22+
diff --git a/src/security/tpm/tspi/log-tpm1.c b/src/security/tpm/tspi/log-tpm1.c
23+
index 481b569cd5..453e74b4e8 100644
24+
--- a/src/security/tpm/tspi/log-tpm1.c
25+
+++ b/src/security/tpm/tspi/log-tpm1.c
26+
@@ -33,7 +33,7 @@ void *tpm1_log_cbmem_init(void)
27+
if (!tclt)
28+
return NULL;
29+
30+
- memset(tclt, 0, sizeof(*tclt));
31+
+ memset(tclt, 0, tpm_log_len);
32+
hdr = &tclt->spec_id;
33+
34+
/* Fill in first "header" entry. */
35+
--
36+
2.39.5
37+

0 commit comments

Comments
 (0)