[PATCH] KEYS: trusted: Fix blob allocation size in tpm2_key_decode()

[PATCH] KEYS: trusted: Fix blob allocation size in tpm2_key_decode()

[Stefano Garzarella]

From: Stefano Garzarella <sgarzare@redhat.com>

tpm2_key_decode() allocates 4 bytes more than needed. The ASN.1
callbacks tpm2_key_priv() and tpm2_key_pub() provide the lengths
of TPM2B_PRIVATE and TPM2B_PUBLIC, so ctx.priv_len and ctx.pub_len
already account for the 2-byte `size` field each of those structures
starts with.

I noticed this while reviewing commit 114f00d738f1 ("KEYS: trusted:
Fix tpm2_load_cmd() boundary check"), which correctly reports
ctx.priv_len + ctx.pub_len as the decoded blob size [1].

Let's allocate exactly that amount, matching the data copied into
the blob.

[1] https://lore.kernel.org/linux-integrity/apfoKo-BdwaLXtkT@sgarzare-redhat/

Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
---
 security/keys/trusted-keys/trusted_tpm2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c
index 01f18bb37047..a9b8a31a637c 100644
--- a/security/keys/trusted-keys/trusted_tpm2.c
+++ b/security/keys/trusted-keys/trusted_tpm2.c
@@ -115,7 +115,7 @@ static int tpm2_key_decode(struct trusted_key_payload *payload,
 	if (ctx.priv_len + ctx.pub_len > MAX_BLOB_SIZE)
 		return -EINVAL;
 
-	blob = kmalloc(ctx.priv_len + ctx.pub_len + 4, GFP_KERNEL);
+	blob = kmalloc(ctx.priv_len + ctx.pub_len, GFP_KERNEL);
 	if (!blob)
 		return -ENOMEM;
 
-- 
2.55.0

Re: [PATCH] KEYS: trusted: Fix blob allocation size in tpm2_key_decode()

[Jarkko Sakkinen]

On Wed, Sep 23, 2026 at 07:35:06PM +0200, Stefano Garzarella wrote:
> From: Stefano Garzarella <sgarzare@redhat.com>
> 
> tpm2_key_decode() allocates 4 bytes more than needed. The ASN.1
> callbacks tpm2_key_priv() and tpm2_key_pub() provide the lengths
> of TPM2B_PRIVATE and TPM2B_PUBLIC, so ctx.priv_len and ctx.pub_len
> already account for the 2-byte `size` field each of those structures
> starts with.
> 
> I noticed this while reviewing commit 114f00d738f1 ("KEYS: trusted:
> Fix tpm2_load_cmd() boundary check"), which correctly reports
> ctx.priv_len + ctx.pub_len as the decoded blob size [1].
> 
> Let's allocate exactly that amount, matching the data copied into
> the blob.
> 
> [1] https://lore.kernel.org/linux-integrity/apfoKo-BdwaLXtkT@sgarzare-redhat/
> 
> Fixes: f2219745250f ("security: keys: trusted: use ASN.1 TPM2 key format for the blobs")
> Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
> ---
>  security/keys/trusted-keys/trusted_tpm2.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c
> index 01f18bb37047..a9b8a31a637c 100644
> --- a/security/keys/trusted-keys/trusted_tpm2.c
> +++ b/security/keys/trusted-keys/trusted_tpm2.c
> @@ -115,7 +115,7 @@ static int tpm2_key_decode(struct trusted_key_payload *payload,
>  	if (ctx.priv_len + ctx.pub_len > MAX_BLOB_SIZE)
>  		return -EINVAL;
>  
> -	blob = kmalloc(ctx.priv_len + ctx.pub_len + 4, GFP_KERNEL);
> +	blob = kmalloc(ctx.priv_len + ctx.pub_len, GFP_KERNEL);
>  	if (!blob)
>  		return -ENOMEM;
>  
> -- 
> 2.55.0
> 

Yeah, we talked this over so not much to say about this:

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

Thanks.

Br, Jarkko