Jarkko Sakkinen

A issue in the Linux kernel has been identified where DCP trusted keys can crash during encryption and decryption of the blob encryption key via the DCP crypto driver when vmalloc stack addresses are enabled. This is caused by improper use of `sg init one()` with vmalloc'd stack buffers, specifically `plain key blob`.

The issue is related to the TPM SPI transfer mechanism in the Linux kernel, which does not account for the 4 bytes of header that prepends the SPI data frame. This can result in out-of-bounds accesses and was confirmed with KASAN. The introduction of SPI HDRSIZE is intended to account for the header and allocate the transfer buffer correctly.

The issue is related to a memory leak in the `tpm2 key encode()` function in the Trusted Platform Module (TPM) subsystem of the Linux kernel. This leak occurs because the `scratch` variable is never freed. The fix involves calling `kfree()` in both the success and error cases. Exploitation of this issue could allow an attacker to cause a denial of service.

A memory leak has been identified in the Linux kernel, specifically in the trusted key module. The issue arises from two error return paths that fail to free the allocated object `td`, resulting in a memory leak. This leak is addressed by ensuring that the error return path securely frees `td`. The fix also resolves a clang scan-build warning related to a potential memory leak in the `trusted tpm1.c` file.