Re: [PATCH 1/2] tpm: sessions: bound the primary public area by the response size

[Jarkko Sakkinen <jarkko@kernel.org>]

On Fri, Nov 06, 2026 at 09:49:35AM +0800, Guo Zihao wrote:
> tpm2_parse_create_primary() reads the size of the TPM2B_PUBLIC area
> from the response and hashes it to compute the object name:
> 
> 	len = tpm_buf_read_u16(buf, &offset_r);
> 	offset_t = offset_r;
> 	if (name) {
> 		/*
> 		 * now we have the public area, compute the name of
> 		 * the object
> 		 */
> 		put_unaligned_be16(TPM_ALG_SHA256, name);
> 		sha256(&buf->data[offset_r], len, name + 2);
> 	}
> 
> The length is only checked against the response later, after the
> hash has been taken. A TPM that reports a public area longer than
> what it actually sent makes the sha256() run past the end of the
> received data and hash whatever follows the response in the buffer.
> 
> Check that the public area fits in the response before hashing it.
> 
> Fixes: d2add27cf2b8 ("tpm: Add NULL primary creation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guo Zihao <guozh23@xiaopeng.com>

I think it is not a bug fix without a source.

I.e., unless this is TCG defined behavior, I'd not add fixes tag.

Br, Jarkko