Re: [PATCH 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy

[Jarkko Sakkinen]

On Wed, Aug 26, 2026 at 08:18:32AM +0200, Greg KH wrote:
> On Tue, Aug 25, 2026 at 06:29:18PM +0000, sn0x-sharma wrote:
> > tpm_seal() computes storedsize from TPM response fields and passes
> > it directly to memcpy() into a MAX_BLOB_SIZE buffer without bounds
> > validation. A forged TPM response can set storedsize to 4086,
> > overflowing the 512-byte blob by 3574 bytes into adjacent slab
> > objects.
> > 
> > Add a check that storedsize does not exceed MAX_BLOB_SIZE before
> > the memcpy, returning -EINVAL on oversized responses.
> > 
> > Reported-by: sn0x-sharma <sanketsharmacsec@xxxxxxxxx>
> > Link: https://lore.kernel.org/linux-integrity/
> 
> That's not a valid link :(

Oops, missed this one ;-)

Should be just deleted, b4 shazam will set the link tag.

> 
> > Signed-off-by: sn0x-sharma <sanketsharmacsec@xxxxxxxxx>
> 
> No need for a reported-by: if you author and sign off on the patch.
> 
> And we need a real name please, not an alias.
> 
> thanks,
> 
> greg k-h

BR, Jarkko