[PATCH v3 0/2] tpm: bounds-check device-reported response lengths

A TPM reply's length is taken from the device and only upper-capped, then
several callers use it unchecked: the TPM1 OIAP helpers and the TPM2
GetCapability parser subtract a fixed header length from it, so a reply too
short underflows the subtraction into a huge memcpy; the GetCapability
parser then copies that many bytes into the caller's buffer, so a reply
longer than the buffer overruns it. Because a TPM sits on a physically
accessible bus, a cheap bus interposer (the kind used to sniff
disk-encryption keys) can inject such a reply, and on the TPM2 path this
parsing runs during measured boot, which is exactly the physical attacker
that measured boot is meant to resist.

Patch 1 checks the reported length once in tpm_sendrecv_command(), so every
command that reads a reply rejects a too-short response, and keeps a buffer
bound on the GetCapability properties query. Patch 2 adds regression tests
driving the parser with a truncated and an over-long reply through the
sandbox emulator.

Based on v2026.07 (fdfe2ec48d5c). A reproducer is available on request.

Signed-off-by: Shahriyar Jalayeri <[email protected]>
---
Changes in v3:
- Rework per review: check the response length once in
  tpm_sendrecv_command() instead of at each call site, so every command
  that reads a reply is guarded. Drop the per-site lower-bound checks; keep
  the GetCapability buffer bound.
- Drop Miquel's Acked-by, as the fix changed substantially.

Changes in v2:
- Use my real name in the From and Signed-off-by (Miquel Raynal)

---
Shahriyar Jalayeri (2):
      tpm: bounds-check the device-reported response length
      test: tpm: check malformed capability responses are rejected

 drivers/tpm/tpm2_tis_sandbox.c | 28 ++++++++++++++++++++
 include/tpm-v2.h               | 10 +++++++
 lib/tpm-common.c               | 16 +++++++++---
 lib/tpm-utils.h                |  8 +++++-
 lib/tpm-v1.c                   | 59 +++++++++++++++++++++++++-----------------
 lib/tpm-v2.c                   | 52 ++++++++++++++++++++++---------------
 test/dm/tpm.c                  | 42 ++++++++++++++++++++++++++++++
 7 files changed, 166 insertions(+), 49 deletions(-)
---
base-commit: fdfe2ec48d5c1c2ed03073d73edd3fdd3fe1ffa1
change-id: 20260723-tpm-trunc-resp-664a3babf1cf

Best regards,
--  
Shahriyar Jalayeri <[email protected]>