* [PATCH v1] tee: sandbox: check for buffer size
@ 2024-04-21 20:48 Igor Opaniuk
2024-04-22 14:52 ` Oleksandr Suvorov
2024-04-26 5:18 ` Ilias Apalodimas
0 siblings, 2 replies; 3+ messages in thread
From: Igor Opaniuk @ 2024-04-21 20:48 UTC (permalink / raw)
To: u-boot
Cc: jens.wiklander, Ilias Apalodimas, Igor Opaniuk,
Heinrich Schuchardt, Jorge Ramirez-Ortiz, Sam Protsenko,
Simon Glass, Tom Rini
Add additional check for buffer size when reading out persistent
storage value and provide back actual value size.
Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
---
drivers/tee/sandbox.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c
index 8ad7c09efdd..86b16a3bb8d 100644
--- a/drivers/tee/sandbox.c
+++ b/drivers/tee/sandbox.c
@@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
uint slot;
u64 val;
char *value;
- u32 value_sz;
+ u32 value_sz, tmp_sz;
switch (func) {
case TA_AVB_CMD_READ_ROLLBACK_INDEX:
@@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
if (!ep)
return TEE_ERROR_ITEM_NOT_FOUND;
- value_sz = strlen(ep->data) + 1;
- memcpy(value, ep->data, value_sz);
+ tmp_sz = strlen(ep->data) + 1;
+ if (value_sz < tmp_sz)
+ return TEE_ERROR_SHORT_BUFFER;
+
+ memcpy(value, ep->data, tmp_sz);
+ params[1].u.memref.size = tmp_sz;
return TEE_SUCCESS;
case TA_AVB_CMD_WRITE_PERSIST_VALUE:
--
2.34.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH v1] tee: sandbox: check for buffer size
2024-04-21 20:48 [PATCH v1] tee: sandbox: check for buffer size Igor Opaniuk
@ 2024-04-22 14:52 ` Oleksandr Suvorov
2024-04-26 5:18 ` Ilias Apalodimas
1 sibling, 0 replies; 3+ messages in thread
From: Oleksandr Suvorov @ 2024-04-22 14:52 UTC (permalink / raw)
To: Igor Opaniuk
Cc: u-boot, jens.wiklander, Ilias Apalodimas, Heinrich Schuchardt,
Jorge Ramirez-Ortiz, Sam Protsenko, Simon Glass, Tom Rini
On Sun, Apr 21, 2024 at 11:48 PM Igor Opaniuk <igor.opaniuk@gmail.com> wrote:
>
> Add additional check for buffer size when reading out persistent
> storage value and provide back actual value size.
>
> Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
Reviewed-by: Oleksandr Suvorov <cryosay@gmail.com>
> ---
>
> drivers/tee/sandbox.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c
> index 8ad7c09efdd..86b16a3bb8d 100644
> --- a/drivers/tee/sandbox.c
> +++ b/drivers/tee/sandbox.c
> @@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
> uint slot;
> u64 val;
> char *value;
> - u32 value_sz;
> + u32 value_sz, tmp_sz;
>
> switch (func) {
> case TA_AVB_CMD_READ_ROLLBACK_INDEX:
> @@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
> if (!ep)
> return TEE_ERROR_ITEM_NOT_FOUND;
>
> - value_sz = strlen(ep->data) + 1;
> - memcpy(value, ep->data, value_sz);
> + tmp_sz = strlen(ep->data) + 1;
> + if (value_sz < tmp_sz)
> + return TEE_ERROR_SHORT_BUFFER;
> +
> + memcpy(value, ep->data, tmp_sz);
> + params[1].u.memref.size = tmp_sz;
>
> return TEE_SUCCESS;
> case TA_AVB_CMD_WRITE_PERSIST_VALUE:
> --
> 2.34.1
>
--
Best regards,
Oleksandr Suvorov
Software Engineer
T: +380 63 8489656
E: oleksandr.suvorov@foundries.io
W: www.foundries.io
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v1] tee: sandbox: check for buffer size
2024-04-21 20:48 [PATCH v1] tee: sandbox: check for buffer size Igor Opaniuk
2024-04-22 14:52 ` Oleksandr Suvorov
@ 2024-04-26 5:18 ` Ilias Apalodimas
1 sibling, 0 replies; 3+ messages in thread
From: Ilias Apalodimas @ 2024-04-26 5:18 UTC (permalink / raw)
To: Igor Opaniuk
Cc: u-boot, jens.wiklander, Heinrich Schuchardt, Jorge Ramirez-Ortiz,
Sam Protsenko, Simon Glass, Tom Rini
On Sun, Apr 21, 2024 at 10:48:39PM +0200, Igor Opaniuk wrote:
> Add additional check for buffer size when reading out persistent
> storage value and provide back actual value size.
>
> Signed-off-by: Igor Opaniuk <igor.opaniuk@gmail.com>
> ---
>
> drivers/tee/sandbox.c | 10 +++++++---
> 1 file changed, 7 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/tee/sandbox.c b/drivers/tee/sandbox.c
> index 8ad7c09efdd..86b16a3bb8d 100644
> --- a/drivers/tee/sandbox.c
> +++ b/drivers/tee/sandbox.c
> @@ -174,7 +174,7 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
> uint slot;
> u64 val;
> char *value;
> - u32 value_sz;
> + u32 value_sz, tmp_sz;
>
> switch (func) {
> case TA_AVB_CMD_READ_ROLLBACK_INDEX:
> @@ -267,8 +267,12 @@ static u32 ta_avb_invoke_func(struct udevice *dev, u32 func, uint num_params,
> if (!ep)
> return TEE_ERROR_ITEM_NOT_FOUND;
>
> - value_sz = strlen(ep->data) + 1;
> - memcpy(value, ep->data, value_sz);
> + tmp_sz = strlen(ep->data) + 1;
> + if (value_sz < tmp_sz)
> + return TEE_ERROR_SHORT_BUFFER;
> +
> + memcpy(value, ep->data, tmp_sz);
> + params[1].u.memref.size = tmp_sz;
>
> return TEE_SUCCESS;
> case TA_AVB_CMD_WRITE_PERSIST_VALUE:
> --
> 2.34.1
>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2024-04-26 5:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-04-21 20:48 [PATCH v1] tee: sandbox: check for buffer size Igor Opaniuk
2024-04-22 14:52 ` Oleksandr Suvorov
2024-04-26 5:18 ` Ilias Apalodimas
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox