> While the backend (thread) is accessing the request and response buffers,
> do not clear those buffers upon a command cancellation. Still clear them
> in all other cases, though.
>
> Fixes: 29315d22b259 ("hw/tpm: Add internal buffer state for chunking")
It's the following commit that makes use of it, but ok
This may also lead to OOB read/crashes from malicious guest driver.
> Signed-off-by: Stefan Berger <[email protected]>
> Message-ID: <[email protected]>
>
> diff --git a/hw/tpm/tpm_crb.c b/hw/tpm/tpm_crb.c
> index 54fa2042b5a8..e5e33a3a2ff4 100644
> --- a/hw/tpm/tpm_crb.c
> +++ b/hw/tpm/tpm_crb.c
> @@ -218,8 +218,9 @@ static void tpm_crb_mmio_write(void *opaque, hwaddr addr,
> if (val == CRB_CANCEL_INVOKE) {
> if (s->regs[R_CRB_CTRL_START] & CRB_START_INVOKE) {
> tpm_backend_cancel_cmd(s->tpmbe);
> + } else {
> + tpm_crb_clear_internal_buffers(s);
> }
> - tpm_crb_clear_internal_buffers(s);
> }
> break;
> case A_CRB_CTRL_START:
Reviewed-by: Marc-André Lureau <[email protected]>
--
Marc-André Lureau <[email protected]>
