Patchwork [1/2] efi: Fix cast to pointer from integer of different size in TPM log code

login
register
mail settings
Submitter Matthew Garrett
Date April 2, 2019, 9:55 p.m.
Message ID <20190402215556.257406-2-matthewgarrett@google.com>
Download mbox | patch
Permalink /patch/763949/
State New
Headers show

Comments

Matthew Garrett - April 2, 2019, 9:55 p.m.
8bfcff4a6a1d9d7226bb63a7da758b82d9ab4373 introduced a cast from
efi_physical_address_t to (void *), which are different sizes on 32-bit.
Fix that. Caught by the 0-day test bot.

Signed-off-by: Matthew Garrett <mjg59@google.com>
---
 drivers/firmware/efi/libstub/tpm.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
David Laight - April 3, 2019, 1:42 p.m.
From: Matthew Garrett

> Sent: 02 April 2019 22:56

> 

> 8bfcff4a6a1d9d7226bb63a7da758b82d9ab4373 introduced a cast from

> efi_physical_address_t to (void *), which are different sizes on 32-bit.

> Fix that. Caught by the 0-day test bot.


Casting a physical address to 'void *' seems completely wrong.
Also you'd need a guarantee that the address was below 4G or the result
is meaningless.
Looks to me like something is using the wrong types somewhere.

	David

> Signed-off-by: Matthew Garrett <mjg59@google.com>

> ---

>  drivers/firmware/efi/libstub/tpm.c | 4 ++--

>  1 file changed, 2 insertions(+), 2 deletions(-)

> 

> diff --git a/drivers/firmware/efi/libstub/tpm.c b/drivers/firmware/efi/libstub/tpm.c

> index b6e93e14fcf1..6b3b507a54eb 100644

> --- a/drivers/firmware/efi/libstub/tpm.c

> +++ b/drivers/firmware/efi/libstub/tpm.c

> @@ -114,8 +114,8 @@ void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg)

>  			 */

>  			last_entry_size =

>  				__calc_tpm2_event_size((void *)last_entry_addr,

> -						       (void *)log_location,

> -						       false);

> +						    (void *)(long)log_location,

> +						    false);

>  		} else {

>  			last_entry_size = sizeof(struct tcpa_event) +

>  			   ((struct tcpa_event *) last_entry_addr)->event_size;

> --

> 2.21.0.392.gf8f6787159e-goog


-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)
Matthew Garrett - April 3, 2019, 4:51 p.m.
On Wed, Apr 3, 2019 at 6:41 AM David Laight <David.Laight@aculab.com> wrote:
>
> From: Matthew Garrett
> > Sent: 02 April 2019 22:56
> >
> > 8bfcff4a6a1d9d7226bb63a7da758b82d9ab4373 introduced a cast from
> > efi_physical_address_t to (void *), which are different sizes on 32-bit.
> > Fix that. Caught by the 0-day test bot.
>
> Casting a physical address to 'void *' seems completely wrong.
> Also you'd need a guarantee that the address was below 4G or the result
> is meaningless.
> Looks to me like something is using the wrong types somewhere.

We're in UEFI here, not the kernel proper - the firmware functions we
call give us back physical addresses, and we're operating with a 1:1
mapping. long is 64 bit on 64 bit systems, and on 32 bit systems we've
already asserted that all firmware resources are under 4GB (obviously
we're going to have a bad time if they're not, but there's not really
anything we can do about that)
Jarkko Sakkinen - April 4, 2019, 12:39 p.m.
On Tue, Apr 02, 2019 at 02:55:55PM -0700, Matthew Garrett wrote:
> 8bfcff4a6a1d9d7226bb63a7da758b82d9ab4373 introduced a cast from
> efi_physical_address_t to (void *), which are different sizes on 32-bit.
> Fix that. Caught by the 0-day test bot.
> 
> Signed-off-by: Matthew Garrett <mjg59@google.com>

Reviewed-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>

/Jarkko
Ard Biesheuvel - April 4, 2019, 12:54 p.m.
On Wed, 3 Apr 2019 at 04:56, Matthew Garrett <matthewgarrett@google.com> wrote:
>
> 8bfcff4a6a1d9d7226bb63a7da758b82d9ab4373

Which tree is this commit in?

> introduced a cast from
> efi_physical_address_t to (void *), which are different sizes on 32-bit.
> Fix that. Caught by the 0-day test bot.
>
> Signed-off-by: Matthew Garrett <mjg59@google.com>

Acked-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>

I'll pick this up as a fix if we can clean up the commit log so it
doesn't refer to a commit that does not exist in mainline.

> ---
>  drivers/firmware/efi/libstub/tpm.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/firmware/efi/libstub/tpm.c b/drivers/firmware/efi/libstub/tpm.c
> index b6e93e14fcf1..6b3b507a54eb 100644
> --- a/drivers/firmware/efi/libstub/tpm.c
> +++ b/drivers/firmware/efi/libstub/tpm.c
> @@ -114,8 +114,8 @@ void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg)
>                          */
>                         last_entry_size =
>                                 __calc_tpm2_event_size((void *)last_entry_addr,
> -                                                      (void *)log_location,
> -                                                      false);
> +                                                   (void *)(long)log_location,
> +                                                   false);
>                 } else {
>                         last_entry_size = sizeof(struct tcpa_event) +
>                            ((struct tcpa_event *) last_entry_addr)->event_size;
> --
> 2.21.0.392.gf8f6787159e-goog
>
Matthew Garrett - April 4, 2019, 5:23 p.m.
On Thu, Apr 4, 2019 at 5:54 AM Ard Biesheuvel <ard.biesheuvel@linaro.org> wrote:
>
> On Wed, 3 Apr 2019 at 04:56, Matthew Garrett <matthewgarrett@google.com> wrote:
> >
> > 8bfcff4a6a1d9d7226bb63a7da758b82d9ab4373
>
> Which tree is this commit in?

Sorry, these are in the tpmdd-next tree.

Patch

diff --git a/drivers/firmware/efi/libstub/tpm.c b/drivers/firmware/efi/libstub/tpm.c
index b6e93e14fcf1..6b3b507a54eb 100644
--- a/drivers/firmware/efi/libstub/tpm.c
+++ b/drivers/firmware/efi/libstub/tpm.c
@@ -114,8 +114,8 @@  void efi_retrieve_tpm2_eventlog(efi_system_table_t *sys_table_arg)
 			 */
 			last_entry_size =
 				__calc_tpm2_event_size((void *)last_entry_addr,
-						       (void *)log_location,
-						       false);
+						    (void *)(long)log_location,
+						    false);
 		} else {
 			last_entry_size = sizeof(struct tcpa_event) +
 			   ((struct tcpa_event *) last_entry_addr)->event_size;