Re: [PATCH v4 2/2] test: tpm: check malformed capability and OIAP responses are rejected

Hi Shahriyar,

On 2026-07-29T18:25:21, shj <[email protected]> wrote:
> test: tpm: check malformed capability and OIAP responses are rejected
>
> The length of a TPM reply comes from the device and cannot be trusted to
> be well-formed. Add DM tests for the malformed replies that the length
> checks reject.
>
> For TPM2 GetCapability: one reply too short to hold its header, and one
> advertising more data than the caller's buffer holds. The sandbox emulator
> gains two test-only capability properties that produce them; the short
> reply is caught by the length check in tpm_sendrecv_command(), the
> over-long one by the caller's buffer bound.
>
> For the TPM1 OIAP helpers tpm1_load_key2_oiap() and
> tpm1_get_pub_key_oiap(): a reply too short to hold the auth trailer that
> their length arithmetic subtracts. The emulator answers OIAP with a zeroed
> session and both commands with a truncated reply, so the length check
> rejects them before the subtraction underflows. These paths need
> CONFIG_TPM_AUTH_SESSIONS, enabled here in the sandbox config.
>
> Signed-off-by: Shahriyar Jalayeri <[email protected]>
> [...]
>
> configs/sandbox_defconfig      |  1 +
>  drivers/tpm/tpm2_tis_sandbox.c | 28 ++++++++++++++
>  drivers/tpm/tpm_tis_sandbox.c  |  9 +++++
>  include/tpm-v2.h               | 10 +++++
>  test/dm/tpm.c                  | 88 ++++++++++++++++++++++++++++++++++++++++++
>  5 files changed, 136 insertions(+)

> +#if CONFIG_IS_ENABLED(TPM_AUTH_SESSIONS)
> +/*
> + * A TPM1 OIAP reply carries an auth trailer that is subtracted from a
> + * device-controlled length. Check that a LoadKey2 reply too short to hold that
> + * trailer is rejected, rather than parsed with an underflowed length.
> + */
> +static int dm_test_tpm1_load_key2_oiap_short(struct unit_test_state *uts)

Both OIAP helpers now have coverage, and the truncated
LoadKey2/GetPubKey replies drive the length check exactly. TPM_HDR_LEN
is 10, well below the 55/41 minima these commands declare, so the
guard trips as intended.

Reviewed-by: Simon Glass <[email protected]>