Re: [PATCH v2 1/2] tpm: bounds-check the device-controlled response length

Simon,

On 28.07.26 20:41, Simon Glass wrote:
> This bounds the copy against a size derived from prop_count, not against
> the real size of buf, which the function is never told. It is safe today
> only because every caller happens to pass a buffer of at least
> sizeof(u32) + prop_count * sizeof(struct tpms_tagged_property) bytes. The
> kerneldoc does not spell that out - it describes @prop_count only as
> 'Size of output buffer', which reads as a byte count rather than a
> property count:
>
>      @prop_count Size of output buffer
>
> So the memcpy() safety rests on an undocumented contract. Since you are
> hardening this path, please can you pass the caller's actual buffer
> length and bound the copy against that, and document what @prop_count
> means? That also sidesteps what the bound should be for capabilities
> other than TPM2_CAP_TPM_PROPERTIES, where the copy is still unbounded.
> What do you think?
>
> Regards,
> Simon

Right, v4 gives tpm2_get_capability() a buf_size argument and bounds the 
copy against it for every capability, the TPM2_CAP_TPM_PROPERTIES 
special-case is gone.

Thanks,
Shah