Re: [PATCH 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy

[Greg KH]

On Tue, Aug 25, 2026 at 06:29:18PM +0000, sn0x-sharma wrote:
> tpm_seal() computes storedsize from TPM response fields and passes
> it directly to memcpy() into a MAX_BLOB_SIZE buffer without bounds
> validation. A forged TPM response can set storedsize to 4086,
> overflowing the 512-byte blob by 3574 bytes into adjacent slab
> objects.
> 
> Add a check that storedsize does not exceed MAX_BLOB_SIZE before
> the memcpy, returning -EINVAL on oversized responses.
> 
> Reported-by: sn0x-sharma <sanketsharmacsec@xxxxxxxxx>
> Link: https://lore.kernel.org/linux-integrity/

That's not a valid link :(

> Signed-off-by: sn0x-sharma <sanketsharmacsec@xxxxxxxxx>

No need for a reported-by: if you author and sign off on the patch.

And we need a real name please, not an alias.

thanks,

greg k-h