Kernel trusted-keys path hardens TPM1 seal and HMAC checks

Two fixes landed on the Linux kernel mailing list for the TPM 1.x trusted-keys path, closing holes that let a forged TPM response corrupt kernel memory or bypass integrity checks when sealing secrets.

Trusted keys store sensitive material under TPM protection. In the seal path, the kernel took a size field from the TPM reply and copied that many bytes into a fixed-size blob buffer with no upper bound. An oversized value could write thousands of bytes past the end of the buffer into adjacent slab memory. The change rejects any response whose claimed blob length exceeds the buffer limit and fails the operation instead of copying.

Separately, the TPM 1.x HMAC verification helpers treated an unauthenticated response tag as success and returned without checking the MAC. A crafted reply using that tag could therefore skip integrity verification. Review feedback simplified the fix: drop the special-case accept path so only properly authenticated response tags pass, and everything else is rejected.

Sanket Sharma reported and authored both changes. Sudhakar Kuppusamy reviewed them. Maintainers Greg Kroah-Hartman and Jarkko Sakkinen pressed for a real-name sign-off and cleaner commit metadata before acceptance. No CVE identifier appears in the submission traffic; assignment, if any, follows the kernel project's usual process after merge.