tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

tpm2-sessions: Fix missing tpm_buf_destroy() in tpm2_read_public()

tpm2_read_public() calls tpm_buf_init() but fails to call
tpm_buf_destroy() on two exit paths, leaking a page allocation:

1. When name_size() returns an error (unrecognized hash algorithm),
the function returns directly without destroying the buffer.

2. On the success path, the buffer is never destroyed before
returning.

All other error paths in the function correctly call
tpm_buf_destroy() before returning.

Fix both by adding the missing tpm_buf_destroy() calls.

Cc: stable@vger.kernel.org # v6.19+
Fixes: bda1cbf73c6e ("tpm2-sessions: Fix tpm2_read_public range checks")
Signed-off-by: Gunnar Kudrjavets <gunnarku@amazon.com>
Reviewed-by: Justinien Bouron <jbouron@amazon.com>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

authored by

Gunnar Kudrjavets and committed by
Jarkko Sakkinen f0f75a3d 666c1a2c

+4 -1
+4 -1
drivers/char/tpm/tpm2-sessions.c
··· 203 203 rc = tpm_buf_read_u16(&buf, &offset); 204 204 name_size_alg = name_size(&buf.data[offset]); 205 205 206 - if (name_size_alg < 0) 206 + if (name_size_alg < 0) { 207 + tpm_buf_destroy(&buf); 207 208 return name_size_alg; 209 + } 208 210 209 211 if (rc != name_size_alg) { 210 212 tpm_buf_destroy(&buf); ··· 219 217 } 220 218 221 219 memcpy(name, &buf.data[offset], rc); 220 + tpm_buf_destroy(&buf); 222 221 return name_size_alg; 223 222 } 224 223 #endif /* CONFIG_TCG_TPM2_HMAC */