Re: [PATCH] tee: qcomtee: user: check the parameter count from the supplicant

[Jens Wiklander]

On Wed, Nov 4, 2026 at 8:37 PM Amirreza Zarrabi
<amirreza.zarrabi@xxxxxxxxxxxxxxxx> wrote:
>
> Hi Jens,
>
> On 11/4/2026 4:58 AM, Jens Wiklander wrote:
> > Hi,
> >
> > On Wed, Aug 5, 2026 at 11:23 AM HyeongJun An <sammiee5311@xxxxxxxxx> wrote:
> >>
> >> The qcomtee_cb_params_to_args() walks the argument array QTEE asked for and
> >> indexes the parameter array the supplicant supplied, but it never looks at
> >> num_params. A supplicant that answers TEE_IOC_SUPPL_SEND with fewer
> >> parameters than the request needs makes that walk read past the end of the
> >> allocation.
> >>
> >> To fix this, reject a response that is too short, the way ureq_select()
> >> already does for the receive direction.
> >>
> >> Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver")
> >> Assisted-by: Claude:claude-opus-5
> >> Signed-off-by: HyeongJun An <sammiee5311@xxxxxxxxx>
> >> ---
> >>  drivers/tee/qcomtee/user_obj.c | 4 ++++
> >>  1 file changed, 4 insertions(+)
> >>
> >> diff --git a/drivers/tee/qcomtee/user_obj.c b/drivers/tee/qcomtee/user_obj.c
> >> index 10452fcc7ccb..2a594ae299da 100644
> >> --- a/drivers/tee/qcomtee/user_obj.c
> >> +++ b/drivers/tee/qcomtee/user_obj.c
> >> @@ -507,6 +507,10 @@ static int qcomtee_cb_params_to_args(struct qcomtee_arg *u,
> >>  {
> >>         int i;
> >>
> >> +       /* Supplicant can not send fewer parameters than requested. */
> >> +       if (num_params < qcomtee_args_len(u))
> >> +               return -EINVAL;
> >> +
> >>         qcomtee_arg_for_each(i, u) {
> >>                 switch (u[i].type) {
> >>                 case QCOMTEE_ARG_TYPE_IB:
> >> --
> >> 2.43.0
> >>
> >
> > Looks good. Amir, do you agree?
>
> Yes. It's correct. The check is missing.
>
> Reviewed-by: Amirreza Zarrabi <amirreza.zarrabi@xxxxxxxxxxxxxxxx>

I'm picking this up and dropping the Assisted-by tag since we don't
use that anymore.

Cheers,
Jens