On Wed, Sep 02, 2026 at 11:24:16AM +0200, Stefano Garzarella wrote:
> On Tue, Sep 01, 2026 at 11:58:06PM +0300, Jarkko Sakkinen wrote:
> > tpm2_load_cmd() does boundary checks against the ASN.1 size i.e.,
> > payload->blob_len. Address this by passing the decoded blob size to
> > tpm2_load_cmd(), and use it for the boundary checks.
> >
> > Cc: [email protected] # v5.13+
> > Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format
> > for the blobs")
> > Reported-by: [email protected]
> > Closes: https://bugs.sh/b/6a581c4284f721d4/
> > Signed-off-by: Jarkko Sakkinen <[email protected]>
> > ---
> > security/keys/trusted-keys/trusted_tpm2.c | 12 +++++++-----
> > 1 file changed, 7 insertions(+), 5 deletions(-)
> >
> > diff --git a/security/keys/trusted-keys/trusted_tpm2.c
> > b/security/keys/trusted-keys/trusted_tpm2.c
> > index 67225dd562a9..01f18bb37047 100644
> > --- a/security/keys/trusted-keys/trusted_tpm2.c
> > +++ b/security/keys/trusted-keys/trusted_tpm2.c
> > @@ -99,7 +99,7 @@ struct tpm2_key_context {
> >
> > static int tpm2_key_decode(struct trusted_key_payload *payload,
> > struct trusted_key_options *options,
> > - u8 **buf)
> > + u8 **buf, unsigned int *blob_len)
> > {
> > int ret;
> > struct tpm2_key_context ctx;
> > @@ -120,6 +120,7 @@ static int tpm2_key_decode(struct trusted_key_payload
> > *payload,
>
> blob = kmalloc(ctx.priv_len + ctx.pub_len + 4, GFP_KERNEL);
>
> Pre-existing, but is `+ 4` here useless?
I checked this through in detail.
It should not be like that given that callbacks tpm2_key_{pub,priv}
provide the length of TPM2B_PUBLIC and TPM2B_PRIVATE.
Thus, it is a bug introduced by f2219745250f ("security: keys: trusted:
use ASN.1 TPM2 key format for the blobs")
BR, Jarkko
