Re: [PATCH v3 1/4] tpm2-sessions: fix out of range indexing in name_size

[Jarkko Sakkinen]

On Thu, Dec 04, 2025 at 03:11:26PM +0000, Jonathan McDowell wrote:
> On Thu, Dec 04, 2025 at 12:12:11AM +0200, Jarkko Sakkinen wrote:
> > 'name_size' does not have any range checks, and it just directly indexes
> > with TPM_ALG_ID, which could lead into memory corruption at worst.
> > 
> > Address the issue by only processing known values and returning -EINVAL for
> > unrecognized values.
> > 
> > Make also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so
> > that errors are detected before causing any spurious TPM traffic.
> > 
> > End also the authorization session on failure in both of the functions, as
> > the session state would be then by definition corrupted.
> > 
> > Cc: stable@xxxxxxxxxxxxxxx # v6.10+
> > Fixes: 1085b8276bb4 ("tpm: Add the rest of the session HMAC API")
> > Signed-off-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
> 
> A minor whitespace query below, but:
> 
> Reviewed-by: Jonathan McDowell <noodles@xxxxxxxx>

Thanks. I updated the commit and removed the extra whitespace.

BR, Jarkko