On Wed, Sep 23, 2026 at 07:35:06PM +0200, Stefano Garzarella wrote: > From: Stefano Garzarella <[email protected]> > > tpm2_key_decode() allocates 4 bytes more than needed. The ASN.1 > callbacks tpm2_key_priv() and tpm2_key_pub() provide the lengths > of TPM2B_PRIVATE and TPM2B_PUBLIC, so ctx.priv_len and ctx.pub_len > already account for the 2-byte `size` field each of those structures > starts with. > > I noticed this while reviewing commit 114f00d738f1 ("KEYS: trusted: > Fix tpm2_load_cmd() boundary check"), which correctly reports > ctx.priv_len + ctx.pub_len as the decoded blob size [1]. > > Let's allocate exactly that amount, matching the data copied into > the blob. > > [1] https://lore.kernel.org/linux-integrity/apfoKo-BdwaLXtkT@sgarzare-redhat/ > > Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for > the blobs") > Signed-off-by: Stefano Garzarella <[email protected]> > --- > security/keys/trusted-keys/trusted_tpm2.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/security/keys/trusted-keys/trusted_tpm2.c > b/security/keys/trusted-keys/trusted_tpm2.c > index 01f18bb37047..a9b8a31a637c 100644 > --- a/security/keys/trusted-keys/trusted_tpm2.c > +++ b/security/keys/trusted-keys/trusted_tpm2.c > @@ -115,7 +115,7 @@ static int tpm2_key_decode(struct trusted_key_payload > *payload, > if (ctx.priv_len + ctx.pub_len > MAX_BLOB_SIZE) > return -EINVAL; > > - blob = kmalloc(ctx.priv_len + ctx.pub_len + 4, GFP_KERNEL); > + blob = kmalloc(ctx.priv_len + ctx.pub_len, GFP_KERNEL); > if (!blob) > return -ENOMEM; > > -- > 2.55.0 >
Yeah, we talked this over so not much to say about this: Reviewed-by: Jarkko Sakkinen <[email protected]> Thanks. Br, Jarkko
