[PATCH] tee: qcomtee: user: check the parameter count from the supplicant
HyeongJun An <[email protected]>
| Newsgroups | org.trustedfirmware.lists.op-tee,org.kernel.vger.linux-arm-msm,org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
The qcomtee_cb_params_to_args() walks the argument array QTEE asked for and
indexes the parameter array the supplicant supplied, but it never looks at
num_params. A supplicant that answers TEE_IOC_SUPPL_SEND with fewer
parameters than the request needs makes that walk read past the end of the
allocation.
To fix this, reject a response that is too short, the way ureq_select()
already does for the receive direction.
Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver")
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <[email protected]>
---
drivers/tee/qcomtee/user_obj.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/tee/qcomtee/user_obj.c b/drivers/tee/qcomtee/user_obj.c
index 10452fcc7ccb..2a594ae299da 100644
--- a/drivers/tee/qcomtee/user_obj.c
+++ b/drivers/tee/qcomtee/user_obj.c
@@ -507,6 +507,10 @@ static int qcomtee_cb_params_to_args(struct qcomtee_arg *u,
{
int i;
+ /* Supplicant can not send fewer parameters than requested. */
+ if (num_params < qcomtee_args_len(u))
+ return -EINVAL;
+
qcomtee_arg_for_each(i, u) {
switch (u[i].type) {
case QCOMTEE_ARG_TYPE_IB:
--
2.43.0