Re: [PATCH v2 1/2] tpm: sessions: bound the primary public area by the response size

[Jarkko Sakkinen]

On Mon, Nov 09, 2026 at 09:49:54AM +0800, Guo Zihao wrote:
> tpm2_parse_create_primary() reads the size of the TPM2B_PUBLIC area
> from the response and hashes it to compute the object name:
> 
> 	len = tpm_buf_read_u16(buf, &offset_r);
> 	offset_t = offset_r;
> 	if (name) {
> 		/*
> 		 * now we have the public area, compute the name of
> 		 * the object
> 		 */
> 		put_unaligned_be16(TPM_ALG_SHA256, name);
> 		sha256(&buf->data[offset_r], len, name + 2);
> 	}
> 
> The length is only checked against the response later, after the
> hash has been taken. A TPM that reports a public area longer than
> what it actually sent makes the sha256() run past the end of the
> received data and hash whatever follows the response in the buffer.
> 
> Check that the public area fits in the response before hashing it.
> 
> Signed-off-by: Guo Zihao <guozh23@xxxxxxxxxxxx>
> ---
> 
> v2: Drop the Fixes and Cc: stable tags, as suggested by Jarkko
> Sakkinen: a TPM reporting an oversized public area is not known
> to violate the TCG specification, so this is hardening rather
> than a bug fix. No code changes.
> 
>  drivers/char/tpm/tpm2-sessions.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c
> index cf8f1fd6790b..e140079dbc13 100644
> --- a/drivers/char/tpm/tpm2-sessions.c
> +++ b/drivers/char/tpm/tpm2-sessions.c
> @@ -1125,6 +1125,8 @@ static int tpm2_parse_create_primary(struct tpm_chip *chip, struct tpm_buf *buf,
>  		return -EINVAL;
>  	len = tpm_buf_read_u16(buf, &offset_r);
>  	offset_t = offset_r;
> +	if (offset_r + len > tpm_buf_length(buf))
> +		return -EINVAL;
>  	if (name) {
>  		/*
>  		 * now we have the public area, compute the name of
> -- 
> 2.50.1
> 

Thanks this change itself is great and well described.

Reviewed-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>

Br, Jarkko