tpm_emulator: Disconnect if response exceeds negotiated buffer size
Disconnect from the emulator if a response was to exceed the negotiated buffer size. The TPM TIS and SPAPR use 4096 bytes and the CRB 3968 bytes. There are currently no TPM 2 responses using this size of a buffer and therefore no response will be sent that is exceeding this size. Fixes: f4ede81eed29 ("tpm: Added support for TPM emulator") Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com> Link: https://lore.kernel.org/qemu-devel/20260511142219.797048-3-stefanb@linux.ibm.com Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Stefan Berger committed
May 11, 2026 at 14:22 UTC
f0602ce389ccda0e8df35ccaec3c1024478a0b10
1 file changed
+20
-2
backends/tpm/tpm_emulator.c
+20
-2
@@ -176,8 +176,10 @@ static int tpm_emulator_unix_tx_bufs(TPMEmulator *tpm_emu,
176
bool *selftest_done,
177
Error **errp)
178
{
179
- ssize_t ret;
179
bool is_selftest = false;
180
+ Error *local_err = NULL;
181
+ uint32_t to_read;
182
+ ssize_t ret;
183
184
if (selftest_done) {
185
*selftest_done = false;
@@ -195,9 +197,25 @@ static int tpm_emulator_unix_tx_bufs(TPMEmulator *tpm_emu,
197
return -1;
198
}
199
200
+ /*
201
+ * Size of response from emulator must be <= out_len (= negotiated buffer
202
+ * size)
203
+ */
204
+ to_read = tpm_cmd_get_size(out);
205
+ if (to_read > out_len) {
206
+ if (qio_channel_shutdown(tpm_emu->data_ioc, QIO_CHANNEL_SHUTDOWN_BOTH,
207
+ &local_err) < 0) {
208
+ error_report_err(local_err);
209
+ }
210
+ error_setg(errp, "tpm-emulator: Disconnected after receiving "
211
+ "unacceptable large response (%u > %u)",
212
+ to_read, out_len);
213
+ return -1;
214
+ }
215
+
216
ret = qio_channel_read_all(tpm_emu->data_ioc,
217
(char *)out + sizeof(struct tpm_resp_hdr),
200
- tpm_cmd_get_size(out) - sizeof(struct tpm_resp_hdr), errp);
218
+ to_read - sizeof(struct tpm_resp_hdr), errp);
219
if (ret != 0) {
220
return -1;
221
}