From 595ca21f797e43da24cb80529fb8b29381ed8716 Mon Sep 17 00:00:00 2001 From: Gunnar Kudrjavets Date: Sun, 10 May 2026 17:11:27 +0000 Subject: [PATCH] tpm: Initialize name_size_alg for non-NULL name in tpm_buf_append_name() tpm_buf_append_name() supports callers passing a pre-computed name for handles. When name is non-NULL, the code skips the tpm2_read_public() path but leaves name_size_alg uninitialized before it is used as the memcpy size argument. No current in-tree caller passes a non-NULL name, but future use cases such as name caching would exercise this path. Initialize name_size_alg by calling name_size() on the caller-provided name, sharing the error check and assignment with the existing tpm2_read_public() path. This prevents unmasking a latent bug when the non-NULL name path is eventually used. Assisted-by: Kiro:claude-opus-4.6 Reviewed-by: Justinien Bouron Reviewed-by: Muhammad Hammad Ijaz Signed-off-by: Gunnar Kudrjavets Link: https://lore.kernel.org/r/20260510171152.4607-1-gunnarku@amazon.com Signed-off-by: Jarkko Sakkinen --- drivers/char/tpm/tpm2-sessions.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c index c4da6fde748f..795cd99dc6fe 100644 --- a/drivers/char/tpm/tpm2-sessions.c +++ b/drivers/char/tpm/tpm2-sessions.c @@ -285,11 +285,14 @@ int tpm_buf_append_name(struct tpm_chip *chip, struct tpm_buf *buf, mso == TPM2_MSO_NVRAM) { if (!name) { ret = tpm2_read_public(chip, handle, auth->name[slot]); - if (ret < 0) - goto err; - - name_size_alg = ret; + } else { + ret = name_size(name); } + + if (ret < 0) + goto err; + + name_size_alg = ret; } else { if (name) { dev_err(&chip->dev, "handle 0x%08x does not use a name\n",