* [PATCH] KEYS: trusted: Fix tpm2_load_cmd() boundary check
@ 2026-09-01 20:58 Jarkko Sakkinen
2026-09-02 9:24 ` Stefano Garzarella
2026-09-03 9:31 ` Srish Srinivasan
0 siblings, 2 replies; 3+ messages in thread
From: Jarkko Sakkinen @ 2026-09-01 20:58 UTC (permalink / raw)
To: linux-integrity
Cc: Jarkko Sakkinen, stable, co+6a581c4284f721d4, James Bottomley,
Mimi Zohar, David Howells, Paul Moore, James Morris,
Serge E. Hallyn, Jonathan McDowell, Ross Philipson, Stefan Berger,
Stefano Garzarella, Srish Srinivasan, keyrings,
linux-security-module, linux-kernel
tpm2_load_cmd() does boundary checks against the ASN.1 size i.e.,
payload->blob_len. Address this by passing the decoded blob size to
tpm2_load_cmd(), and use it for the boundary checks.
Cc: stable@vger.kernel.org # v5.13+
Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
Reported-by: co+6a581c4284f721d4@bugs.sh
Closes: https://bugs.sh/b/6a581c4284f721d4/
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
---
security/keys/trusted-keys/trusted_tpm2.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c
index 67225dd562a9..01f18bb37047 100644
--- a/security/keys/trusted-keys/trusted_tpm2.c
+++ b/security/keys/trusted-keys/trusted_tpm2.c
@@ -99,7 +99,7 @@ struct tpm2_key_context {
static int tpm2_key_decode(struct trusted_key_payload *payload,
struct trusted_key_options *options,
- u8 **buf)
+ u8 **buf, unsigned int *blob_len)
{
int ret;
struct tpm2_key_context ctx;
@@ -120,6 +120,7 @@ static int tpm2_key_decode(struct trusted_key_payload *payload,
return -ENOMEM;
*buf = blob;
+ *blob_len = ctx.priv_len + ctx.pub_len;
options->keyhandle = ctx.parent;
memcpy(blob, ctx.priv, ctx.priv_len);
@@ -384,10 +385,11 @@ static int tpm2_load_cmd(struct tpm_chip *chip,
int rc;
u32 attrs;
- rc = tpm2_key_decode(payload, options, &blob);
+ rc = tpm2_key_decode(payload, options, &blob, &blob_len);
if (rc) {
/* old form */
blob = payload->blob;
+ blob_len = payload->blob_len;
payload->old_format = 1;
} else {
/* Bind for cleanup: */
@@ -399,17 +401,17 @@ static int tpm2_load_cmd(struct tpm_chip *chip,
return -EINVAL;
/* must be big enough for at least the two be16 size counts */
- if (payload->blob_len < 4)
+ if (blob_len < 4)
return -EINVAL;
private_len = get_unaligned_be16(blob);
/* must be big enough for following public_len */
- if (private_len + 2 + 2 > (payload->blob_len))
+ if (private_len + 2 + 2 > blob_len)
return -E2BIG;
public_len = get_unaligned_be16(blob + 2 + private_len);
- if (private_len + 2 + public_len + 2 > payload->blob_len)
+ if (private_len + 2 + public_len + 2 > blob_len)
return -E2BIG;
pub = blob + 2 + private_len + 2;
--
2.47.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] KEYS: trusted: Fix tpm2_load_cmd() boundary check
2026-09-01 20:58 [PATCH] KEYS: trusted: Fix tpm2_load_cmd() boundary check Jarkko Sakkinen
@ 2026-09-02 9:24 ` Stefano Garzarella
2026-09-03 9:31 ` Srish Srinivasan
1 sibling, 0 replies; 3+ messages in thread
From: Stefano Garzarella @ 2026-09-02 9:24 UTC (permalink / raw)
To: Jarkko Sakkinen
Cc: linux-integrity, stable, co+6a581c4284f721d4, James Bottomley,
Mimi Zohar, David Howells, Paul Moore, James Morris,
Serge E. Hallyn, Jonathan McDowell, Ross Philipson, Stefan Berger,
Srish Srinivasan, keyrings, linux-security-module, linux-kernel
On Tue, Sep 01, 2026 at 11:58:06PM +0300, Jarkko Sakkinen wrote:
>tpm2_load_cmd() does boundary checks against the ASN.1 size i.e.,
>payload->blob_len. Address this by passing the decoded blob size to
>tpm2_load_cmd(), and use it for the boundary checks.
>
>Cc: stable@vger.kernel.org # v5.13+
>Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
>Reported-by: co+6a581c4284f721d4@bugs.sh
>Closes: https://bugs.sh/b/6a581c4284f721d4/
>Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
>---
> security/keys/trusted-keys/trusted_tpm2.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
>diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c
>index 67225dd562a9..01f18bb37047 100644
>--- a/security/keys/trusted-keys/trusted_tpm2.c
>+++ b/security/keys/trusted-keys/trusted_tpm2.c
>@@ -99,7 +99,7 @@ struct tpm2_key_context {
>
> static int tpm2_key_decode(struct trusted_key_payload *payload,
> struct trusted_key_options *options,
>- u8 **buf)
>+ u8 **buf, unsigned int *blob_len)
> {
> int ret;
> struct tpm2_key_context ctx;
>@@ -120,6 +120,7 @@ static int tpm2_key_decode(struct trusted_key_payload *payload,
blob = kmalloc(ctx.priv_len + ctx.pub_len + 4, GFP_KERNEL);
Pre-existing, but is `+ 4` here useless?
I'm not asking to fix here, just noticed while reviewing.
Maybe we can set *blob_len earlier and use it also in the kmalloc().
Not a strong opinion, that said this LGTM:
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
if (!blob)
> return -ENOMEM;
>
> *buf = blob;
>+ *blob_len = ctx.priv_len + ctx.pub_len;
> options->keyhandle = ctx.parent;
>
> memcpy(blob, ctx.priv, ctx.priv_len);
>@@ -384,10 +385,11 @@ static int tpm2_load_cmd(struct tpm_chip *chip,
> int rc;
> u32 attrs;
>
>- rc = tpm2_key_decode(payload, options, &blob);
>+ rc = tpm2_key_decode(payload, options, &blob, &blob_len);
> if (rc) {
> /* old form */
> blob = payload->blob;
>+ blob_len = payload->blob_len;
> payload->old_format = 1;
> } else {
> /* Bind for cleanup: */
>@@ -399,17 +401,17 @@ static int tpm2_load_cmd(struct tpm_chip *chip,
> return -EINVAL;
>
> /* must be big enough for at least the two be16 size counts */
>- if (payload->blob_len < 4)
>+ if (blob_len < 4)
> return -EINVAL;
>
> private_len = get_unaligned_be16(blob);
>
> /* must be big enough for following public_len */
>- if (private_len + 2 + 2 > (payload->blob_len))
>+ if (private_len + 2 + 2 > blob_len)
> return -E2BIG;
>
> public_len = get_unaligned_be16(blob + 2 + private_len);
>- if (private_len + 2 + public_len + 2 > payload->blob_len)
>+ if (private_len + 2 + public_len + 2 > blob_len)
> return -E2BIG;
>
> pub = blob + 2 + private_len + 2;
>--
>2.47.3
>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] KEYS: trusted: Fix tpm2_load_cmd() boundary check
2026-09-01 20:58 [PATCH] KEYS: trusted: Fix tpm2_load_cmd() boundary check Jarkko Sakkinen
2026-09-02 9:24 ` Stefano Garzarella
@ 2026-09-03 9:31 ` Srish Srinivasan
1 sibling, 0 replies; 3+ messages in thread
From: Srish Srinivasan @ 2026-09-03 9:31 UTC (permalink / raw)
To: Jarkko Sakkinen, linux-integrity
Cc: stable, co+6a581c4284f721d4, James Bottomley, Mimi Zohar,
David Howells, Paul Moore, James Morris, Serge E. Hallyn,
Jonathan McDowell, Ross Philipson, Stefan Berger,
Stefano Garzarella, keyrings, linux-security-module, linux-kernel
On 9/2/26 2:28 AM, Jarkko Sakkinen wrote:
> tpm2_load_cmd() does boundary checks against the ASN.1 size i.e.,
> payload->blob_len. Address this by passing the decoded blob size to
> tpm2_load_cmd(), and use it for the boundary checks.
>
> Cc: stable@vger.kernel.org # v5.13+
> Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
> Reported-by: co+6a581c4284f721d4@bugs.sh
> Closes: https://bugs.sh/b/6a581c4284f721d4/
> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: Srish Srinivasan <ssrish@linux.ibm.com>
> ---
> security/keys/trusted-keys/trusted_tpm2.c | 12 +++++++-----
> 1 file changed, 7 insertions(+), 5 deletions(-)
>
> diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c
> index 67225dd562a9..01f18bb37047 100644
> --- a/security/keys/trusted-keys/trusted_tpm2.c
> +++ b/security/keys/trusted-keys/trusted_tpm2.c
> @@ -99,7 +99,7 @@ struct tpm2_key_context {
>
> static int tpm2_key_decode(struct trusted_key_payload *payload,
> struct trusted_key_options *options,
> - u8 **buf)
> + u8 **buf, unsigned int *blob_len)
> {
> int ret;
> struct tpm2_key_context ctx;
> @@ -120,6 +120,7 @@ static int tpm2_key_decode(struct trusted_key_payload *payload,
> return -ENOMEM;
>
> *buf = blob;
> + *blob_len = ctx.priv_len + ctx.pub_len;
> options->keyhandle = ctx.parent;
>
> memcpy(blob, ctx.priv, ctx.priv_len);
> @@ -384,10 +385,11 @@ static int tpm2_load_cmd(struct tpm_chip *chip,
> int rc;
> u32 attrs;
>
> - rc = tpm2_key_decode(payload, options, &blob);
> + rc = tpm2_key_decode(payload, options, &blob, &blob_len);
> if (rc) {
> /* old form */
> blob = payload->blob;
> + blob_len = payload->blob_len;
> payload->old_format = 1;
> } else {
> /* Bind for cleanup: */
> @@ -399,17 +401,17 @@ static int tpm2_load_cmd(struct tpm_chip *chip,
> return -EINVAL;
>
> /* must be big enough for at least the two be16 size counts */
> - if (payload->blob_len < 4)
> + if (blob_len < 4)
> return -EINVAL;
>
> private_len = get_unaligned_be16(blob);
>
> /* must be big enough for following public_len */
> - if (private_len + 2 + 2 > (payload->blob_len))
> + if (private_len + 2 + 2 > blob_len)
> return -E2BIG;
>
> public_len = get_unaligned_be16(blob + 2 + private_len);
> - if (private_len + 2 + public_len + 2 > payload->blob_len)
> + if (private_len + 2 + public_len + 2 > blob_len)
> return -E2BIG;
>
> pub = blob + 2 + private_len + 2;
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-03 9:31 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-01 20:58 [PATCH] KEYS: trusted: Fix tpm2_load_cmd() boundary check Jarkko Sakkinen
2026-09-02 9:24 ` Stefano Garzarella
2026-09-03 9:31 ` Srish Srinivasan
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox