The qcomtee_cb_params_to_args() walks the argument array QTEE asked for and indexes the parameter array the supplicant supplied, but it never looks at num_params. A supplicant that answers TEE_IOC_SUPPL_SEND with fewer parameters than the request needs makes that walk read past the end of the allocation.

To fix this, reject a response that is too short, the way ureq_select() already does for the receive direction.

Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver") Assisted-by: Claude:claude-opus-5 Signed-off-by: HyeongJun An sammiee5311@gmail.com --- drivers/tee/qcomtee/user_obj.c | 4 ++++ 1 file changed, 4 insertions(+)

diff --git a/drivers/tee/qcomtee/user_obj.c b/drivers/tee/qcomtee/user_obj.c index 10452fcc7ccb..2a594ae299da 100644 --- a/drivers/tee/qcomtee/user_obj.c +++ b/drivers/tee/qcomtee/user_obj.c @@ -507,6 +507,10 @@ static int qcomtee_cb_params_to_args(struct qcomtee_arg *u, { int i;

+ /* Supplicant can not send fewer parameters than requested. */ + if (num_params < qcomtee_args_len(u)) + return -EINVAL; + qcomtee_arg_for_each(i, u) { switch (u[i].type) { case QCOMTEE_ARG_TYPE_IB: