On Wed, Sep 09, 2026 at 11:59:46PM +0300, Jarkko Sakkinen wrote:
On Wed, Sep 02, 2026 at 11:24:16AM +0200, Stefano Garzarella wrote:
On Tue, Sep 01, 2026 at 11:58:06PM +0300, Jarkko Sakkinen wrote:
> tpm2_load_cmd() does boundary checks against the ASN.1 size i.e.,
> payload->blob_len. Address this by passing the decoded blob size to
> tpm2_load_cmd(), and use it for the boundary checks.
>
> Cc: [email protected] # v5.13+
> Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the
blobs")
> Reported-by: [email protected]
> Closes: https://bugs.sh/b/6a581c4284f721d4/
> Signed-off-by: Jarkko Sakkinen <[email protected]>
> ---
> security/keys/trusted-keys/trusted_tpm2.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/security/keys/trusted-keys/trusted_tpm2.c
b/security/keys/trusted-keys/trusted_tpm2.c
> index 67225dd562a9..01f18bb37047 100644
> --- a/security/keys/trusted-keys/trusted_tpm2.c
> +++ b/security/keys/trusted-keys/trusted_tpm2.c
> @@ -99,7 +99,7 @@ struct tpm2_key_context {
>
> static int tpm2_key_decode(struct trusted_key_payload *payload,
> struct trusted_key_options *options,
> - u8 **buf)
> + u8 **buf, unsigned int *blob_len)
> {
> int ret;
> struct tpm2_key_context ctx;
> @@ -120,6 +120,7 @@ static int tpm2_key_decode(struct trusted_key_payload
*payload,
blob = kmalloc(ctx.priv_len + ctx.pub_len + 4, GFP_KERNEL);
Pre-existing, but is `+ 4` here useless?
I checked this through in detail.
It should not be like that given that callbacks tpm2_key_{pub,priv}
provide the length of TPM2B_PUBLIC and TPM2B_PRIVATE.
Thus, it is a bug introduced by f2219745250f ("security: keys: trusted:
use ASN.1 TPM2 key format for the blobs")
Yep, agree. Do you want me to send a fix?
Thanks,
Stefano
