tpm: ibmvtpm: check the response size against the buffer size

The send path validates the transfer size against the size of the
RTCE buffer:

	if (count > ibmvtpm->rtce_size) {
		dev_err(ibmvtpm->dev,
			"Invalid size in send: count=%zd, rtce_size=%d\n",
			count, ibmvtpm->rtce_size);
		return -EIO;
	}

The receive path has no such check: the response length is whatever
the hypervisor reported in the completion CRQ, and it is only
compared against the size the caller asked for before being used to
copy and clear the RTCE buffer:

	len = ibmvtpm->res_len;

	if (count < len) {
		...
		return -EIO;
	}

	spin_lock(&ibmvtpm->rtce_lock);
	memcpy((void *)buf, (void *)ibmvtpm->rtce_buf, len);
	memset(ibmvtpm->rtce_buf, 0, len);

A response length larger than the RTCE buffer makes the memcpy read
past the buffer and the memset clear past it.

Reject a response that does not fit in the RTCE buffer, mirroring
the check the send path already performs.

Fixes: 132f76294744 ("drivers/char/tpm: Add new device driver to support IBM vTPM")
Cc: <redacted>
Signed-off-by: Guo Zihao <redacted>
---
 drivers/char/tpm/tpm_ibmvtpm.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index 6fb4d30eb..bfef4bc14 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c

@@ -121,6 +121,13 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 		return -EIO;
 	}
 
+	if (len > ibmvtpm->rtce_size) {
+		dev_err(ibmvtpm->dev,
+			"Invalid size in recv: res_len=%d, rtce_size=%d\n",
+			len, ibmvtpm->rtce_size);
+		return -EIO;
+	}
+
 	spin_lock(&ibmvtpm->rtce_lock);
 	memcpy((void *)buf, (void *)ibmvtpm->rtce_buf, len);
 	memset(ibmvtpm->rtce_buf, 0, len);

-- 
2.50.1

On Fri, Nov 06, 2026 at 09:49:46AM +0800, Guo Zihao wrote:

The send path validates the transfer size against the size of the
RTCE buffer:

	if (count > ibmvtpm->rtce_size) {
		dev_err(ibmvtpm->dev,
			"Invalid size in send: count=%zd, rtce_size=%d\n",
			count, ibmvtpm->rtce_size);
		return -EIO;
	}

The receive path has no such check: the response length is whatever
the hypervisor reported in the completion CRQ, and it is only
compared against the size the caller asked for before being used to
copy and clear the RTCE buffer:

	len = ibmvtpm->res_len;

	if (count < len) {
		...
		return -EIO;
	}

	spin_lock(&ibmvtpm->rtce_lock);
	memcpy((void *)buf, (void *)ibmvtpm->rtce_buf, len);
	memset(ibmvtpm->rtce_buf, 0, len);

A response length larger than the RTCE buffer makes the memcpy read
past the buffer and the memset clear past it.

Reject a response that does not fit in the RTCE buffer, mirroring
the check the send path already performs.

Fixes: 132f76294744 ("drivers/char/tpm: Add new device driver to support IBM vTPM")
Cc: <redacted>
Signed-off-by: Guo Zihao <redacted>
---

Ditto. I.e, I'm not sure if this is a bug fix or just better validation
for failing components.

Br, Jarkko

The send path validates the transfer size against the size of the
RTCE buffer:

	if (count > ibmvtpm->rtce_size) {
		dev_err(ibmvtpm->dev,
			"Invalid size in send: count=%zd, rtce_size=%d\n",
			count, ibmvtpm->rtce_size);
		return -EIO;
	}

The receive path has no such check: the response length is whatever
the hypervisor reported in the completion CRQ, and it is only
compared against the size the caller asked for before being used to
copy and clear the RTCE buffer:

	len = ibmvtpm->res_len;

	if (count < len) {
		...
		return -EIO;
	}

	spin_lock(&ibmvtpm->rtce_lock);
	memcpy((void *)buf, (void *)ibmvtpm->rtce_buf, len);
	memset(ibmvtpm->rtce_buf, 0, len);

A response length larger than the RTCE buffer makes the memcpy read
past the buffer and the memset clear past it.

Reject a response that does not fit in the RTCE buffer, mirroring
the check the send path already performs.

Signed-off-by: Guo Zihao <redacted>
---

v2: Drop the Fixes and Cc: stable tags, as suggested by Jarkko
Sakkinen: a hypervisor reporting an oversized response is not
known to violate the architecture, so this is hardening rather
than a bug fix. No code changes.

3 more lines

diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c
index 6fb4d30eb6f6..bfef4bc14767 100644
--- a/drivers/char/tpm/tpm_ibmvtpm.c
+++ b/drivers/char/tpm/tpm_ibmvtpm.c

@@ -121,6 +121,13 @@ static int tpm_ibmvtpm_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 		return -EIO;
 	}
 
+	if (len > ibmvtpm->rtce_size) {
+		dev_err(ibmvtpm->dev,
+			"Invalid size in recv: res_len=%d, rtce_size=%d\n",
+			len, ibmvtpm->rtce_size);
+		return -EIO;
+	}
+
 	spin_lock(&ibmvtpm->rtce_lock);
 	memcpy((void *)buf, (void *)ibmvtpm->rtce_buf, len);
 	memset(ibmvtpm->rtce_buf, 0, len);

-- 
2.50.1