Re: [PATCH v2 1/2] keys: trusted: tpm1: add bounds check in tpm_seal() before memcpy

[Sudhakar Kuppusamy]

> On 26 Aug 2026, at 1:34 PM, Sanket Sharma <sanketsharmacsec@xxxxxxxxx> wrote:
> 
> tpm_seal() computes storedsize from TPM response fields and passes
> it directly to memcpy() into a MAX_BLOB_SIZE buffer without bounds
> validation. A forged TPM response can set storedsize to 4086,
> overflowing the 512-byte blob by 3574 bytes into adjacent slab
> objects.
> 
> Add a check that storedsize does not exceed MAX_BLOB_SIZE before
> the memcpy, returning -EINVAL on oversized responses.
> 
> Signed-off-by: Sanket Sharma <sanketsharmacsec@xxxxxxxxx>

Reviewed-by: Sudhakar Kuppusamy <sudhakar@xxxxxxxxxxxxx>


Thanks,
Sudhakar

> ---
> security/keys/trusted-keys/trusted_tpm1.c | 4 ++++
> 1 file changed, 4 insertions(+)
> 
> diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
> index 8f57c6111..d47cb7108 100644
> --- a/security/keys/trusted-keys/trusted_tpm1.c
> +++ b/security/keys/trusted-keys/trusted_tpm1.c
> @@ -531,6 +531,10 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype,
> 
> /* copy the returned blob to caller */
> if (!ret) {
> + if (storedsize > MAX_BLOB_SIZE) {
> + ret = -EINVAL;
> + goto out;
> + }
> memcpy(blob, tb->data + TPM_DATA_OFFSET, storedsize);
> *bloblen = storedsize;
> }
> -- 
> 2.53.0
> 
>