[PATCH 1/1] tpm: ignore duplicate PCR banks in tpm2_get_pcr_allocation

[Yuqi Xu]

The TPM2_CAP_PCRS response is external input and may contain duplicate
hash algorithms.  tpm2_get_pcr_allocation() adds every active selection
to allocated_banks, while tpm_sysfs_add_device() has one group slot per
distinct hash algorithm.  Eight duplicate selections can therefore make
it write past chip->groups[].

Keep allocated_banks unique by ignoring duplicate hash algorithms while
parsing the response.

Fixes: aab73d952402 ("tpm: add sysfs exports for all banks of PCR registers")
Cc: sta...@vger.kernel.org
Reported-by: Vega <v...@nebusec.ai>
Assisted-by: LLM
Signed-off-by: Yuqi Xu <xuyuqi...@gmail.com>
Reviewed-by: Ren Wei <w...@nebusec.ai>
---
 drivers/char/tpm/tpm2-cmd.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index ae22295df798..99e9d89b18e1 100644
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -527,6 +527,7 @@ ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
        u32 rsp_len;
        int rc;
        int i = 0;
+       int j;
 
        struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
        if (!buf)
@@ -569,13 +570,20 @@ ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
                pcr_select_offset = memchr_inv(pcr_selection.pcr_select, 0,
                                               pcr_selection.size_of_select);
                if (pcr_select_offset) {
-                       chip->allocated_banks[nr_alloc_banks].alg_id = hash_alg;
+                       for (j = 0; j < nr_alloc_banks; j++) {
+                               if (chip->allocated_banks[j].alg_id == hash_alg)
+                                       break;
+                       }
 
-                       rc = tpm2_init_bank_info(chip, nr_alloc_banks);
-                       if (rc < 0)
-                               break;
+                       if (j == nr_alloc_banks) {
+                               chip->allocated_banks[nr_alloc_banks].alg_id = 
hash_alg;
 
-                       nr_alloc_banks++;
+                               rc = tpm2_init_bank_info(chip, nr_alloc_banks);
+                               if (rc < 0)
+                                       break;
+
+                               nr_alloc_banks++;
+                       }
                }
 
                sizeof_pcr_selection = sizeof(pcr_selection.hash_alg) +
-- 
2.55.0