Hi Shahriyar, On 2026-07-29T18:25:21, shj <[email protected]> wrote: > test: tpm: check malformed capability and OIAP responses are rejected > > The length of a TPM reply comes from the device and cannot be trusted to > be well-formed. Add DM tests for the malformed replies that the length > checks reject. > > For TPM2 GetCapability: one reply too short to hold its header, and one > advertising more data than the caller's buffer holds. The sandbox emulator > gains two test-only capability properties that produce them; the short > reply is caught by the length check in tpm_sendrecv_command(), the > over-long one by the caller's buffer bound. > > For the TPM1 OIAP helpers tpm1_load_key2_oiap() and > tpm1_get_pub_key_oiap(): a reply too short to hold the auth trailer that > their length arithmetic subtracts. The emulator answers OIAP with a zeroed > session and both commands with a truncated reply, so the length check > rejects them before the subtraction underflows. These paths need > CONFIG_TPM_AUTH_SESSIONS, enabled here in the sandbox config. > > Signed-off-by: Shahriyar Jalayeri <[email protected]> > [...] > > configs/sandbox_defconfig | 1 + > drivers/tpm/tpm2_tis_sandbox.c | 28 ++++++++++++++ > drivers/tpm/tpm_tis_sandbox.c | 9 +++++ > include/tpm-v2.h | 10 +++++ > test/dm/tpm.c | 88 > ++++++++++++++++++++++++++++++++++++++++++ > 5 files changed, 136 insertions(+)
> +#if CONFIG_IS_ENABLED(TPM_AUTH_SESSIONS) > +/* > + * A TPM1 OIAP reply carries an auth trailer that is subtracted from a > + * device-controlled length. Check that a LoadKey2 reply too short to hold > that > + * trailer is rejected, rather than parsed with an underflowed length. > + */ > +static int dm_test_tpm1_load_key2_oiap_short(struct unit_test_state *uts) Both OIAP helpers now have coverage, and the truncated LoadKey2/GetPubKey replies drive the length check exactly. TPM_HDR_LEN is 10, well below the 55/41 minima these commands declare, so the guard trips as intended. Reviewed-by: Simon Glass <[email protected]>
