# Re: \[PATCH\] tpm: ibmvtpm: check the response size against the buffer size

- From: Jarkko Sakkinen \<jarkko@kernel.org\>
- Date: 2026-11-06 15:23:15 
- List: linuxppc-dev
- Page: https://ratatoskr.run/linuxppc-dev/2026/11/17879374
- Thread: https://ratatoskr.run/linuxppc-dev/2026/11/17875018/t.md

```text
On Fri, Nov 06, 2026 at 09:49:46AM +0800, Guo Zihao wrote:
> The send path validates the transfer size against the size of the
> RTCE buffer:
> 
> 	if (count > ibmvtpm->rtce_size) {
> 		dev_err(ibmvtpm->dev,
> 			"Invalid size in send: count=%zd, rtce_size=%d\n",
> 			count, ibmvtpm->rtce_size);
> 		return -EIO;
> 	}
> 
> The receive path has no such check: the response length is whatever
> the hypervisor reported in the completion CRQ, and it is only
> compared against the size the caller asked for before being used to
> copy and clear the RTCE buffer:
> 
> 	len = ibmvtpm->res_len;
> 
> 	if (count < len) {
> 		...
> 		return -EIO;
> 	}
> 
> 	spin_lock(&ibmvtpm->rtce_lock);
> 	memcpy((void *)buf, (void *)ibmvtpm->rtce_buf, len);
> 	memset(ibmvtpm->rtce_buf, 0, len);
> 
> A response length larger than the RTCE buffer makes the memcpy read
> past the buffer and the memset clear past it.
> 
> Reject a response that does not fit in the RTCE buffer, mirroring
> the check the send path already performs.
> 
> Fixes: 132f76294744 ("drivers/char/tpm: Add new device driver to support IBM vTPM")
> Cc: <redacted>
> Signed-off-by: Guo Zihao <redacted>
> ---

Ditto. I.e, I'm not sure if this is a bug fix or just better validation
for failing components.

Br, Jarkko

```