On Fri, Nov 06, 2026 at 09:49:46AM +0800, Guo Zihao wrote:
> The send path validates the transfer size against the size of the
> RTCE buffer:
>
> if (count > ibmvtpm->rtce_size) {
> dev_err(ibmvtpm->dev,
> "Invalid size in send: count=%zd, rtce_size=%d\n",
> count, ibmvtpm->rtce_size);
> return -EIO;
> }
>
> The receive path has no such check: the response length is whatever
> the hypervisor reported in the completion CRQ, and it is only
> compared against the size the caller asked for before being used to
> copy and clear the RTCE buffer:
>
> len = ibmvtpm->res_len;
>
> if (count < len) {
> ...
> return -EIO;
> }
>
> spin_lock(&ibmvtpm->rtce_lock);
> memcpy((void *)buf, (void *)ibmvtpm->rtce_buf, len);
> memset(ibmvtpm->rtce_buf, 0, len);
>
> A response length larger than the RTCE buffer makes the memcpy read
> past the buffer and the memset clear past it.
>
> Reject a response that does not fit in the RTCE buffer, mirroring
> the check the send path already performs.
>
> Fixes: 132f76294744 ("drivers/char/tpm: Add new device driver to support IBM
> vTPM")
> Cc: [email protected]
> Signed-off-by: Guo Zihao <[email protected]>
> ---
Ditto. I.e, I'm not sure if this is a bug fix or just better validation
for failing components.
Br, Jarkko
