Re: [PATCH] tpm2-sessions: Fix out of range indexing in name_size

[Jarkko Sakkinen <jarkko@kernel.org>]

On Fri, Jan 09, 2026 at 10:45:51AM +0100, Greg KH wrote:
> On Thu, Jan 08, 2026 at 02:33:19PM +0200, Jarkko Sakkinen wrote:
> > On Thu, Jan 08, 2026 at 02:31:59PM +0200, Jarkko Sakkinen wrote:
> > > [ Upstream commit 6e9722e9a7bfe1bbad649937c811076acf86e1fd ]
> > > 
> > > 'name_size' does not have any range checks, and it just directly indexes
> > > with TPM_ALG_ID, which could lead into memory corruption at worst.
> > > 
> > > Address the issue by only processing known values and returning -EINVAL for
> > > unrecognized values.
> > > 
> > > Make also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so
> > > that errors are detected before causing any spurious TPM traffic.
> > > 
> > > End also the authorization session on failure in both of the functions, as
> > > the session state would be then by definition corrupted.
> > > 
> > > Cc: stable@vger.kernel.org # v6.10+
> > > Fixes: 1085b8276bb4 ("tpm: Add the rest of the session HMAC API")
> > > Reviewed-by: Jonathan McDowell <noodles@meta.com>
> > > Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
> > > ---
> > 
> > This is for v6.12.
> 
> Does not apply anymore to the latest 6.12.y release, can you rebase and
> resend?

Sure, I'll fix the issue (reproduced locally) and also run my smoke tests [1]
before sending anything.

> 
> thanks,
> 
> greg k-h

[1] https://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd-test.git

BR, Jarkko