Re: [PATCH] KEYS: trusted: Fix tpm2_load_cmd() boundary check

[Jarkko Sakkinen]

On Wed, Sep 02, 2026 at 11:24:16AM +0200, Stefano Garzarella wrote:
> On Tue, Sep 01, 2026 at 11:58:06PM +0300, Jarkko Sakkinen wrote:
> > tpm2_load_cmd() does boundary checks against the ASN.1 size i.e.,
> > payload->blob_len. Address this by passing the decoded blob size to
> > tpm2_load_cmd(), and use it for the boundary checks.
> > 
> > Cc: stable@xxxxxxxxxxxxxxx # v5.13+
> > Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
> > Reported-by: co+6a581c4284f721d4@xxxxxxx
> > Closes: https://bugs.sh/b/6a581c4284f721d4/
> > Signed-off-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
> > ---
> > security/keys/trusted-keys/trusted_tpm2.c | 12 +++++++-----
> > 1 file changed, 7 insertions(+), 5 deletions(-)
> > 
> > diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c
> > index 67225dd562a9..01f18bb37047 100644
> > --- a/security/keys/trusted-keys/trusted_tpm2.c
> > +++ b/security/keys/trusted-keys/trusted_tpm2.c
> > @@ -99,7 +99,7 @@ struct tpm2_key_context {
> > 
> > static int tpm2_key_decode(struct trusted_key_payload *payload,
> > 			   struct trusted_key_options *options,
> > -			   u8 **buf)
> > +			   u8 **buf, unsigned int *blob_len)
> > {
> > 	int ret;
> > 	struct tpm2_key_context ctx;
> > @@ -120,6 +120,7 @@ static int tpm2_key_decode(struct trusted_key_payload *payload,
> 
> 	blob = kmalloc(ctx.priv_len + ctx.pub_len + 4, GFP_KERNEL);
> 
> Pre-existing, but is `+ 4` here useless?

I checked this through in detail.

It should not be like that given that callbacks tpm2_key_{pub,priv}
provide the length of TPM2B_PUBLIC and TPM2B_PRIVATE.

Thus, it is a bug introduced by f2219745250f ("security: keys: trusted:
use ASN.1 TPM2 key format for the blobs")

BR, Jarkko