From: Gunnar Kudrjavets Date: Sun, 10 May 2026 17:11:27 +0000 (+0000) Subject: tpm: Initialize name_size_alg for non-NULL name in tpm_buf_append_name() X-Git-Tag: v7.2-rc1~63^2~7 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=595ca21f797e43da24cb80529fb8b29381ed8716;p=thirdparty%2Fkernel%2Flinux.git tpm: Initialize name_size_alg for non-NULL name in tpm_buf_append_name() tpm_buf_append_name() supports callers passing a pre-computed name for handles. When name is non-NULL, the code skips the tpm2_read_public() path but leaves name_size_alg uninitialized before it is used as the memcpy size argument. No current in-tree caller passes a non-NULL name, but future use cases such as name caching would exercise this path. Initialize name_size_alg by calling name_size() on the caller-provided name, sharing the error check and assignment with the existing tpm2_read_public() path. This prevents unmasking a latent bug when the non-NULL name path is eventually used. Assisted-by: Kiro:claude-opus-4.6 Reviewed-by: Justinien Bouron Reviewed-by: Muhammad Hammad Ijaz Signed-off-by: Gunnar Kudrjavets Link: https://lore.kernel.org/r/20260510171152.4607-1-gunnarku@amazon.com Signed-off-by: Jarkko Sakkinen --- diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c index c4da6fde748f4..795cd99dc6fed 100644 --- a/drivers/char/tpm/tpm2-sessions.c +++ b/drivers/char/tpm/tpm2-sessions.c @@ -285,11 +285,14 @@ int tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, mso == TPM2_MSO_NVRAM) { if (!name) { ret = tpm2_read_public(chip, handle, auth->name[slot]); - if (ret < 0) - goto err; - - name_size_alg = ret; + } else { + ret = name_size(name); } + + if (ret < 0) + goto err; + + name_size_alg = ret; } else { if (name) { dev_err(&chip->dev, "handle 0x%08x does not use a name\n",