Re: [PATCH v5] tpm: infineon: add bounds check in tpm_inf_recv

[Shahriyar <shahriyar@posteo.de>]

On 10/10/25 10:02 AM, Paul Menzel wrote:
> Dear Shahriyar,
> 
> 
> Thank you for the improved version.
> 
> Am 10.10.25 um 09:49 schrieb Shahriyar Jalayeri:
>> Add two buffer size validations to prevent buffer overflows in
>> tpm_inf_recv():
>>
>> 1. Validate that the provided buffer can hold at least the 4-byte header
>>     before attempting to read it.
>> 2. Validate that the buffer is large enough to hold the data size 
>> reported
>>     by the TPM before reading the payload.
>>
>> Without these checks, a malicious or malfunctioning TPM could cause 
>> buffer
>> overflows by reporting data sizes larger than the provided buffer, 
>> leading
>> to memory corruption.
>>
>> Fixes: ebb81fdb3dd0 ("[PATCH] tpm: Support for Infineon TPM")
>> Signed-off-by: Shahriyar Jalayeri <shahriyar@posteo.de>
>> ---
>> Changelog:
>> v5:
>>     - replaced space indentation with tabs before the header comment
>> v4:
>>     - removed the curly braces around one line statements
>> v3:
>>     - removed dev_err() logs
>>     - added missing "fixes" tag
>>     - described header structure
>>     - fixed commit message length
>>     - removed use of local variable as constant
>>     - fixed check to account for off-by-six bytes
>> v2:
>>     - added complete changes in the commit message
>>     - dev_err() logged expected sizes and stated operation is aborted
>>
>>   drivers/char/tpm/tpm_infineon.c | 7 +++++++
>>   1 file changed, 7 insertions(+)
>>
>> diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/ 
>> tpm_infineon.c
>> index 7638b65b8..d76aae08b 100644
>> --- a/drivers/char/tpm/tpm_infineon.c
>> +++ b/drivers/char/tpm/tpm_infineon.c
>> @@ -250,6 +250,10 @@ static int tpm_inf_recv(struct tpm_chip *chip, u8 
>> * buf, size_t count)
>>       number_of_wtx = 0;
>>   recv_begin:
>> +    /* expect at least 1-byte VL header, 1-byte ctrl-tag, 2-byte data 
>> size */
>> +    if (count < 4)
>> +        return -EIO;
>> +
>>       /* start receiving header */
>>       for (i = 0; i < 4; i++) {
>>           ret = wait(chip, STAT_RDA);
>> @@ -268,6 +272,9 @@ static int tpm_inf_recv(struct tpm_chip *chip, u8 
>> * buf, size_t count)
>>           /* size of the data received */
>>           size = ((buf[2] << 8) | buf[3]);
>> +        if (size + 6 > count)
>> +            return -EIO;
>> +
>>           for (i = 0; i < size; i++) {
>>               wait(chip, STAT_RDA);
>>               buf[i] = tpm_data_in(RDFIFO);
> 
> Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
> 
> 
> Kind regards,
> 
> Paul

Thank you for your patience with newcomers.

-- 
BR.
/shj