Hi Shahriyar, On 2026-07-29T18:25:21, shj <[email protected]> wrote: > tpm: bounds-check the device-reported response length > > The length of a TPM reply is set by the device: tpm_sendrecv_command() > stores the number of bytes received, caps it only at the command buffer > size, and reports success whenever the reply's return code is 0. Callers > then use that length unchecked. The clearest damage is in the parsers that > compute response_length - <header> and index the result (the TPM1 OIAP > helpers and tpm2_get_capability): a reply shorter than the header > underflows the subtraction into a huge memcpy. > > Rather than guard each caller, check the length once at the choke point. > tpm_sendrecv_command() gains a min_response_len argument and rejects a > reply shorter than the caller says it needs, before the caller parses it; > every command that reads a response now declares its minimum. > > tpm2_get_capability() additionally copies response_len - 15 bytes into the > caller's buffer, but was never told how big that buffer is, so a reply > longer than it overruns it. Give the function a buf_size argument and > reject a reply that would not fit, so the copy is bounded for every > capability rather than for the properties query alone. > [...] > > cmd/tpm-v2.c | 4 +++- > include/tpm-v2.h | 5 ++-- > lib/efi_loader/efi_tcg2.c | 9 ++++--- > lib/tpm-common.c | 16 ++++++++++--- > lib/tpm-utils.h | 8 ++++++- > lib/tpm-v1.c | 59 +++++++++++++++++++++++++++------------- > lib/tpm-v2.c | 60 ++++++++++++++++++++++++++++------------- > lib/tpm_api.c | 4 +++- > 8 files changed, 106 insertions(+), 59 deletions(-)
> diff --git a/include/tpm-v2.h b/include/tpm-v2.h > @@ -550,12 +550,13 @@ u32 tpm2_pcr_read(struct udevice *dev, u32 idx, > unsigned int idx_min_sz, > * @capability Partition of capabilities > * @property Further definition of capability, limited to be 4 bytes wide > * @buf Output buffer for capability information > - * @prop_count Size of output buffer > + * @buf_size Size of @buf in bytes > + * @prop_count Number of properties to request > * > * Return: code of the operation > */ > u32 tpm2_get_capability(struct udevice *dev, u32 capability, u32 property, > - void *buf, size_t prop_count); > + void *buf, size_t buf_size, size_t prop_count); The copy is now bounded for every capability, and the kerneldoc distinguishes the two counts. Reviewed-by: Simon Glass <[email protected]>
