The EVENT_TAG branch of get_event_name() casts the event payload to struct tcpa_pc_event and reads from it: pc_event = (struct tcpa_pc_event *)event_entry; switch (do_endian_conversion(pc_event->event_id)) { ... for (i = 0; i < 20; i++) d_len += sprintf(&data[2*i], "%02x", pc_event->event_data[i]); The log iterators only verify that the event header plus the declared event_size stays within the log buffer; they do not require the payload of an EVENT_TAG entry to be large enough for the fields the branch reads. A truncated entry makes the branch read up to 20 bytes of event_data[] past the end of the entry, and, for the last entry in the log, past the end of the buffer itself. The legacy PC Client spec defines the EV_EVENT_TAG payload as a TCPA_PC_EVENT - event_id, event_size and event-type-specific data - so a conformant entry carries the 8-byte header and the hash-type ids carry a full digest. The log itself, however, is an ACPI table the firmware leaves in memory: the TPM never measures the log, so the kernel cannot tell a conformant log from a corrupted one. The iterators already work on that assumption - they stop once the declared event_size runs past the buffer end - and the readers should apply the same rule to what they take off the payload. Skip entries whose payload cannot even hold the event id, and skip the 20-byte digest dump when the payload cannot hold the full tcpa_pc_event header plus the digest, so the branch never reads beyond the entry it is formatting. Fixes: 55a82ab3181b ("[PATCH] tpm: add bios measurement log") Cc: stable@vger.kernel.org Signed-off-by: Guanglei Zhu --- v2: fold the spec rationale from the list discussion into the commit log, per review - what the legacy PC Client spec defines for the tag payload, why the kernel cannot trust the log to conform, and how the iterators already handle it. drivers/char/tpm/eventlog/tpm1.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/char/tpm/eventlog/tpm1.c b/drivers/char/tpm/eventlog/tpm1.c index 0397e33..f93a358 100644 --- a/drivers/char/tpm/eventlog/tpm1.c +++ b/drivers/char/tpm/eventlog/tpm1.c @@ -178,6 +178,10 @@ static int get_event_name(char *dest, struct tcpa_event *event, } break; case EVENT_TAG: + if (do_endian_conversion(event->event_size) < + sizeof(pc_event->event_id)) + break; + pc_event = (struct tcpa_pc_event *)event_entry; /* ToDo Row data -> Base64 */ @@ -203,6 +207,9 @@ static int get_event_name(char *dest, struct tcpa_event *event, name = tcpa_pc_event_id_strings[do_endian_conversion (pc_event->event_id)]; n_len = strlen(name); + if (do_endian_conversion(event->event_size) < + sizeof(struct tcpa_pc_event) + 20) + break; for (i = 0; i < 20; i++) d_len += sprintf(&data[2*i], "%02x", pc_event->event_data[i]); -- 2.43.0