[PATCH] tee: qcomtee: user: check the parameter count from the supplicant

[PATCH] tee: qcomtee: user: check the parameter count from the supplicant

[HyeongJun An]

The qcomtee_cb_params_to_args() walks the argument array QTEE asked for and
indexes the parameter array the supplicant supplied, but it never looks at
num_params. A supplicant that answers TEE_IOC_SUPPL_SEND with fewer
parameters than the request needs makes that walk read past the end of the
allocation.

To fix this, reject a response that is too short, the way ureq_select()
already does for the receive direction.

Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver")
Assisted-by: Claude:claude-opus-5
Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
---
 drivers/tee/qcomtee/user_obj.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/tee/qcomtee/user_obj.c b/drivers/tee/qcomtee/user_obj.c
index 10452fcc7ccb..2a594ae299da 100644
--- a/drivers/tee/qcomtee/user_obj.c
+++ b/drivers/tee/qcomtee/user_obj.c
@@ -507,6 +507,10 @@ static int qcomtee_cb_params_to_args(struct qcomtee_arg *u,
 {
 	int i;
 
+	/* Supplicant can not send fewer parameters than requested. */
+	if (num_params < qcomtee_args_len(u))
+		return -EINVAL;
+
 	qcomtee_arg_for_each(i, u) {
 		switch (u[i].type) {
 		case QCOMTEE_ARG_TYPE_IB:
-- 
2.43.0

Re: [PATCH] tee: qcomtee: user: check the parameter count from the supplicant

[Jens Wiklander]

Hi,

On Wed, Aug 5, 2026 at 11:23 AM HyeongJun An <sammiee5311@gmail.com> wrote:
>
> The qcomtee_cb_params_to_args() walks the argument array QTEE asked for and
> indexes the parameter array the supplicant supplied, but it never looks at
> num_params. A supplicant that answers TEE_IOC_SUPPL_SEND with fewer
> parameters than the request needs makes that walk read past the end of the
> allocation.
>
> To fix this, reject a response that is too short, the way ureq_select()
> already does for the receive direction.
>
> Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver")
> Assisted-by: Claude:claude-opus-5
> Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
> ---
>  drivers/tee/qcomtee/user_obj.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/drivers/tee/qcomtee/user_obj.c b/drivers/tee/qcomtee/user_obj.c
> index 10452fcc7ccb..2a594ae299da 100644
> --- a/drivers/tee/qcomtee/user_obj.c
> +++ b/drivers/tee/qcomtee/user_obj.c
> @@ -507,6 +507,10 @@ static int qcomtee_cb_params_to_args(struct qcomtee_arg *u,
>  {
>         int i;
>
> +       /* Supplicant can not send fewer parameters than requested. */
> +       if (num_params < qcomtee_args_len(u))
> +               return -EINVAL;
> +
>         qcomtee_arg_for_each(i, u) {
>                 switch (u[i].type) {
>                 case QCOMTEE_ARG_TYPE_IB:
> --
> 2.43.0
>

Looks good. Amir, do you agree?

Cheers,
Jens

Re: [PATCH] tee: qcomtee: user: check the parameter count from the supplicant

[Amirreza Zarrabi]

Hi Jens,

On 11/4/2026 4:58 AM, Jens Wiklander wrote:
> Hi,
> 
> On Wed, Aug 5, 2026 at 11:23 AM HyeongJun An <sammiee5311@gmail.com> wrote:
>>
>> The qcomtee_cb_params_to_args() walks the argument array QTEE asked for and
>> indexes the parameter array the supplicant supplied, but it never looks at
>> num_params. A supplicant that answers TEE_IOC_SUPPL_SEND with fewer
>> parameters than the request needs makes that walk read past the end of the
>> allocation.
>>
>> To fix this, reject a response that is too short, the way ureq_select()
>> already does for the receive direction.
>>
>> Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver")
>> Assisted-by: Claude:claude-opus-5
>> Signed-off-by: HyeongJun An <sammiee5311@gmail.com>
>> ---
>>  drivers/tee/qcomtee/user_obj.c | 4 ++++
>>  1 file changed, 4 insertions(+)
>>
>> diff --git a/drivers/tee/qcomtee/user_obj.c b/drivers/tee/qcomtee/user_obj.c
>> index 10452fcc7ccb..2a594ae299da 100644
>> --- a/drivers/tee/qcomtee/user_obj.c
>> +++ b/drivers/tee/qcomtee/user_obj.c
>> @@ -507,6 +507,10 @@ static int qcomtee_cb_params_to_args(struct qcomtee_arg *u,
>>  {
>>         int i;
>>
>> +       /* Supplicant can not send fewer parameters than requested. */
>> +       if (num_params < qcomtee_args_len(u))
>> +               return -EINVAL;
>> +
>>         qcomtee_arg_for_each(i, u) {
>>                 switch (u[i].type) {
>>                 case QCOMTEE_ARG_TYPE_IB:
>> --
>> 2.43.0
>>
> 
> Looks good. Amir, do you agree?

Yes. It's correct. The check is missing.

Reviewed-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>

Best Regards,
Amir

> 
> Cheers,
> Jens