On Sun, May 10, 2026 at 05:11:27PM +0000, Gunnar Kudrjavets wrote: > tpm_buf_append_name() supports callers passing a pre-computed name > for handles. When name is non-NULL, the code skips the > tpm2_read_public() path but leaves name_size_alg uninitialized > before it is used as the memcpy size argument. > > No current in-tree caller passes a non-NULL name, but future use > cases such as name caching would exercise this path. Initialize > name_size_alg by calling name_size() on the caller-provided name, > sharing the error check and assignment with the existing > tpm2_read_public() path. This prevents unmasking a latent bug when > the non-NULL name path is eventually used. > > Assisted-by: Kiro:claude-opus-4.6 > Reviewed-by: Justinien Bouron <[email protected]> > Reviewed-by: Muhammad Hammad Ijaz <[email protected]> > Signed-off-by: Gunnar Kudrjavets <[email protected]> > --- > drivers/char/tpm/tpm2-sessions.c | 11 +++++++---- > 1 file changed, 7 insertions(+), 4 deletions(-) > > diff --git a/drivers/char/tpm/tpm2-sessions.c > b/drivers/char/tpm/tpm2-sessions.c > index c4da6fde748f..795cd99dc6fe 100644 > --- a/drivers/char/tpm/tpm2-sessions.c > +++ b/drivers/char/tpm/tpm2-sessions.c > @@ -285,11 +285,14 @@ int tpm_buf_append_name(struct tpm_chip *chip, struct > tpm_buf *buf, > mso == TPM2_MSO_NVRAM) { > if (!name) { > ret = tpm2_read_public(chip, handle, auth->name[slot]); > - if (ret < 0) > - goto err; > - > - name_size_alg = ret; > + } else { > + ret = name_size(name); > } > + > + if (ret < 0) > + goto err; > + > + name_size_alg = ret; > } else { > if (name) { > dev_err(&chip->dev, "handle 0x%08x does not use a > name\n", > > base-commit: 44bd97559c26bb4d7abac09d29e58a4152d88567 > -- > 2.47.3 >
Thank you. Applied. BR, Jarkko
