Re: [PATCH] KEYS: trusted: Fix tpm2_load_cmd() boundary check

[Jarkko Sakkinen <jarkko@kernel.org>]

On Thu, Sep 10, 2026 at 09:52:38AM +0200, Stefano Garzarella wrote:
> On Wed, Sep 09, 2026 at 11:59:46PM +0300, Jarkko Sakkinen wrote:
> > On Wed, Sep 02, 2026 at 11:24:16AM +0200, Stefano Garzarella wrote:
> > > On Tue, Sep 01, 2026 at 11:58:06PM +0300, Jarkko Sakkinen wrote:
> > > > tpm2_load_cmd() does boundary checks against the ASN.1 size i.e.,
> > > > payload->blob_len. Address this by passing the decoded blob size to
> > > > tpm2_load_cmd(), and use it for the boundary checks.
> > > >
> > > > Cc: stable@vger.kernel.org # v5.13+
> > > > Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
> > > > Reported-by: co+6a581c4284f721d4@bugs.sh
> > > > Closes: https://bugs.sh/b/6a581c4284f721d4/
> > > > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > > ---
> > > > security/keys/trusted-keys/trusted_tpm2.c | 12 +++++++-----
> > > > 1 file changed, 7 insertions(+), 5 deletions(-)
> > > >
> > > > diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c
> > > > index 67225dd562a9..01f18bb37047 100644
> > > > --- a/security/keys/trusted-keys/trusted_tpm2.c
> > > > +++ b/security/keys/trusted-keys/trusted_tpm2.c
> > > > @@ -99,7 +99,7 @@ struct tpm2_key_context {
> > > >
> > > > static int tpm2_key_decode(struct trusted_key_payload *payload,
> > > > 			   struct trusted_key_options *options,
> > > > -			   u8 **buf)
> > > > +			   u8 **buf, unsigned int *blob_len)
> > > > {
> > > > 	int ret;
> > > > 	struct tpm2_key_context ctx;
> > > > @@ -120,6 +120,7 @@ static int tpm2_key_decode(struct trusted_key_payload *payload,
> > > 
> > > 	blob = kmalloc(ctx.priv_len + ctx.pub_len + 4, GFP_KERNEL);
> > > 
> > > Pre-existing, but is `+ 4` here useless?
> > 
> > I checked this through in detail.
> > 
> > It should not be like that given that callbacks tpm2_key_{pub,priv}
> > provide the length of TPM2B_PUBLIC and TPM2B_PRIVATE.
> > 
> > Thus, it is a bug introduced by f2219745250f ("security: keys: trusted:
> > use ASN.1 TPM2 key format for the blobs")
> 
> Yep, agree. Do you want me to send a fix?

Sure, go ahead.

> Thanks,
> Stefano

BR, Jarkko