Re: [PATCH v2 2/2] tpm: sessions: bound the parameter decryption by the response size

[Jarkko Sakkinen <jarkko@kernel.org>]

On Mon, Nov 09, 2026 at 09:49:55AM +0800, Guo Zihao wrote:
> tpm_buf_check_hmac_response() decrypts the parameter area of a
> response for sessions with TPM2_SA_ENCRYPT set:
> 
> 	len = tpm_buf_read_u16(buf, &offset_p);
> 	aes_prepareenckey(&auth->aes_key, auth->scratch, AES_KEY_BYTES);
> 	aescfb_decrypt(&auth->aes_key, &buf->data[offset_p],
> 		       &buf->data[offset_p], len,
> 		       auth->scratch + AES_KEY_BYTES);
> 
> The length is read from the response itself and never checked
> against the buffer: every other size taken from a session response
> is compared to tpm_buf_length(), but not this one. A TPM that
> reports an oversized parameter area makes aescfb_decrypt() walk
> past the end of the buffer, and since the decryption is done in
> place, this both reads and writes whatever follows the received
> data.
> 
> Check that the encrypted parameters fit in the response before
> decrypting them.
> 
> Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>
> ---
> 
> v2: Drop the Fixes and Cc: stable tags, as suggested by Jarkko
> Sakkinen: a TPM reporting an oversized parameter area is not known
> to violate the TCG specification, so this is hardening rather
> than a bug fix. No code changes.
> 
>  drivers/char/tpm/tpm2-sessions.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c
> index e140079dbc13..59c7fdc0c88e 100644
> --- a/drivers/char/tpm/tpm2-sessions.c
> +++ b/drivers/char/tpm/tpm2-sessions.c
> @@ -872,6 +872,10 @@ int tpm_buf_check_hmac_response(struct tpm_chip *chip, struct tpm_buf *buf,
>  			  auth->scratch);
>  
>  		len = tpm_buf_read_u16(buf, &offset_p);
> +		if (offset_p + len > tpm_buf_length(buf)) {
> +			rc = -EINVAL;
> +			goto out;
> +		}
>  		aes_prepareenckey(&auth->aes_key, auth->scratch, AES_KEY_BYTES);
>  		aescfb_decrypt(&auth->aes_key, &buf->data[offset_p],
>  			       &buf->data[offset_p], len,
> -- 
> 2.50.1
> 

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

Br, Jarkko