Re: [PATCH v2] tpm: ibmvtpm: check the response size against the buffer size

[Jarkko Sakkinen <jarkko@kernel.org>]

On Mon, Nov 09, 2026 at 09:49:57AM +0800, Guo Zihao wrote:
> The send path validates the transfer size against the size of the
> RTCE buffer:
> 
> 	if (count > ibmvtpm->rtce_size) {
> 		dev_err(ibmvtpm->dev,
> 			"Invalid size in send: count=%zd, rtce_size=%d\n",
> 			count, ibmvtpm->rtce_size);
> 		return -EIO;
> 	}
> 
> The receive path has no such check: the response length is whatever
> the hypervisor reported in the completion CRQ, and it is only
> compared against the size the caller asked for before being used to
> copy and clear the RTCE buffer:
> 
> 	len = ibmvtpm->res_len;
> 
> 	if (count < len) {
> 		...
> 		return -EIO;
> 	}
> 
> 	spin_lock(&ibmvtpm->rtce_lock);
> 	memcpy((void *)buf, (void *)ibmvtpm->rtce_buf, len);
> 	memset(ibmvtpm->rtce_buf, 0, len);
> 
> A response length larger than the RTCE buffer makes the memcpy read
> past the buffer and the memset clear past it.
> 
> Reject a response that does not fit in the RTCE buffer, mirroring
> the check the send path already performs.
> 
> Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>
> ---
> 
> v2: Drop the Fixes and Cc: stable tags, as suggested by Jarkko
> Sakkinen: a hypervisor reporting an oversized response is not
> known to violate the architecture, so this is hardening rather
> than a bug fix. No code changes.
> 
>  drivers/char/tpm/tpm_ibmvtpm.c | 7 +++++++
>  1 file changed, 7 insertions(+)
> 
> diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
> index 6fb4d30eb6f6..bfef4bc14767 100644
> --- a/drivers/char/tpm/tpm_ibmvtpm.c
> +++ b/drivers/char/tpm/tpm_ibmvtpm.c
> @@ -121,6 +121,13 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
>  		return -EIO;
>  	}
>  
> +	if (len > ibmvtpm->rtce_size) {
> +		dev_err(ibmvtpm->dev,
> +			"Invalid size in recv: res_len=%d, rtce_size=%d\n",
> +			len, ibmvtpm->rtce_size);
> +		return -EIO;
> +	}
> +
>  	spin_lock(&ibmvtpm->rtce_lock);
>  	memcpy((void *)buf, (void *)ibmvtpm->rtce_buf, len);
>  	memset(ibmvtpm->rtce_buf, 0, len);
> -- 
> 2.50.1
> 

Thank you.


Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

Br, Jarkko