Re: [PATCH v4 1/2] tpm: bounds-check the device-reported response length

Hi Shahriyar,

On 2026-07-29T18:25:21, shj <[email protected]> wrote:
> tpm: bounds-check the device-reported response length
>
> The length of a TPM reply is set by the device: tpm_sendrecv_command()
> stores the number of bytes received, caps it only at the command buffer
> size, and reports success whenever the reply's return code is 0. Callers
> then use that length unchecked. The clearest damage is in the parsers that
> compute response_length - <header> and index the result (the TPM1 OIAP
> helpers and tpm2_get_capability): a reply shorter than the header
> underflows the subtraction into a huge memcpy.
>
> Rather than guard each caller, check the length once at the choke point.
> tpm_sendrecv_command() gains a min_response_len argument and rejects a
> reply shorter than the caller says it needs, before the caller parses it;
> every command that reads a response now declares its minimum.
>
> tpm2_get_capability() additionally copies response_len - 15 bytes into the
> caller's buffer, but was never told how big that buffer is, so a reply
> longer than it overruns it. Give the function a buf_size argument and
> reject a reply that would not fit, so the copy is bounded for every
> capability rather than for the properties query alone.
> [...]
>
> cmd/tpm-v2.c              |  4 +++-
>  include/tpm-v2.h          |  5 ++--
>  lib/efi_loader/efi_tcg2.c |  9 ++++---
>  lib/tpm-common.c          | 16 ++++++++++---
>  lib/tpm-utils.h           |  8 ++++++-
>  lib/tpm-v1.c              | 59 +++++++++++++++++++++++++++-------------
>  lib/tpm-v2.c              | 60 ++++++++++++++++++++++++++++-------------
>  lib/tpm_api.c             |  4 +++-
>  8 files changed, 106 insertions(+), 59 deletions(-)

> diff --git a/include/tpm-v2.h b/include/tpm-v2.h
> @@ -550,12 +550,13 @@ u32 tpm2_pcr_read(struct udevice *dev, u32 idx, unsigned int idx_min_sz,
>   * @capability       Partition of capabilities
>   * @property Further definition of capability, limited to be 4 bytes wide
>   * @buf              Output buffer for capability information
> - * @prop_count       Size of output buffer
> + * @buf_size Size of @buf in bytes
> + * @prop_count       Number of properties to request
>   *
>   * Return: code of the operation
>   */
>  u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property,
> -                     void *buf, size_t prop_count);
> +                     void *buf, size_t buf_size, size_t prop_count);

The copy is now bounded for every capability, and the kerneldoc
distinguishes the two counts.

Reviewed-by: Simon Glass <[email protected]>