On Sat, Sep 19, 2026 at 04:47:00PM +0800, Yuqi Xu wrote:
> The TPM2_CAP_PCRS response is external input and may contain duplicate
> hash algorithms. tpm2_get_pcr_allocation() adds every active selection
> to allocated_banks, while tpm_sysfs_add_device() has one group slot per
> distinct hash algorithm. Eight duplicate selections can therefore make
> it write past chip->groups[].
>
> Keep allocated_banks unique by ignoring duplicate hash algorithms while
> parsing the response.
>
> Fixes: aab73d952402 ("tpm: add sysfs exports for all banks of PCR registers")
> Cc: [email protected]
> Reported-by: Vega <[email protected]>
> Assisted-by: LLM
> Signed-off-by: Yuqi Xu <[email protected]>
> Reviewed-by: Ren Wei <[email protected]>
> ---
It may not contain duplicates as per protocol spec i.e., instead of
silently ignoring the error -EIO should be returned. TPM should not
be enabled if it is compromised.
> drivers/char/tpm/tpm2-cmd.c | 18 +++++++++++++-----
> 1 file changed, 13 insertions(+), 5 deletions(-)
>
> diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
> index ae22295df798..99e9d89b18e1 100644
> --- a/drivers/char/tpm/tpm2-cmd.c
> +++ b/drivers/char/tpm/tpm2-cmd.c
> @@ -527,6 +527,7 @@ ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
> u32 rsp_len;
> int rc;
> int i = 0;
> + int j;
>
> struct tpm_buf *buf __free(kfree) = kzalloc(TPM_BUFSIZE, GFP_KERNEL);
> if (!buf)
> @@ -569,13 +570,20 @@ ssize_t tpm2_get_pcr_allocation(struct tpm_chip *chip)
> pcr_select_offset = memchr_inv(pcr_selection.pcr_select, 0,
> pcr_selection.size_of_select);
> if (pcr_select_offset) {
> - chip->allocated_banks[nr_alloc_banks].alg_id = hash_alg;
> + for (j = 0; j < nr_alloc_banks; j++) {
> + if (chip->allocated_banks[j].alg_id == hash_alg)
> + break;
> + }
>
> - rc = tpm2_init_bank_info(chip, nr_alloc_banks);
> - if (rc < 0)
> - break;
> + if (j == nr_alloc_banks) {
> + chip->allocated_banks[nr_alloc_banks].alg_id =
> hash_alg;
>
> - nr_alloc_banks++;
> + rc = tpm2_init_bank_info(chip, nr_alloc_banks);
> + if (rc < 0)
> + break;
> +
> + nr_alloc_banks++;
> + }
> }
>
> sizeof_pcr_selection = sizeof(pcr_selection.hash_alg) +
> --
> 2.55.0
>
Br, Jarkko
