github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Hi,

Browse Source 
Please pull these bug fixes, which have landed after v7.3-rc1.
 
 Br, Jarkko
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRE6pSOnaBC00OEHEIaerohdGur0gUCar9DmQAKCRAaerohdGur
 0sVVAQDxPpzxXpSI1RaGiLK/Xd30r0Oy+mMpjktACUHC4C0KtQEAl32hX/eiGt7k
 dg35RzAKtXfGDl0FOgXo6YnHAVQ5oA0=
 =76Ob
 -----END PGP SIGNATURE-----

Merge tag 'for-next-tpm-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd

Pull tpm fixes from Jarkko Sakkinen.

 - tpm error handling and buffer size fixes

* tag 'for-next-tpm-v7.3-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  tpm: Disable TPM on null key name mismatch
  tpm: fix off-by-four bounds check in tpm2_get_random()
  tpm: Fix auth session leak in tpm2_get_random() error path
  tpm: Fix heap buffer overflow in tpm_transmit_cmd()
This commit is contained in:
Linus Torvalds 2026-10-02 09:07:36 -07:00
commit 17a5800975
3 changed files with 6 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/char/tpm/tpm-interface.c
View File

@ -268,7 +268,7 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf,
int err;
ssize_t len;
len = tpm_transmit(chip, buf->data, PAGE_SIZE);
len = tpm_transmit(chip, buf->data, buf->capacity);
if (len < 0)
return len;

6
drivers/char/tpm/tpm2-cmd.c
View File

@ -281,8 +281,10 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max)
}
tpm_buf_append_u16(buf, num_bytes);
err = tpm_buf_fill_hmac_session(chip, buf);
if (err)
if (err) {
tpm2_end_auth_session(chip);
return err;
}
err = tpm_transmit_cmd(chip, buf,
offsetof(struct tpm2_get_random_out,
@ -305,7 +307,7 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest, size_t max)
out = (struct tpm2_get_random_out *)&buf->data[offset];
recd = min_t(u32, be16_to_cpu(out->size), num_bytes);
if (tpm_buf_length(buf) <
TPM_HEADER_SIZE +
offset +
offsetof(struct tpm2_get_random_out, buffer) +
recd) {
tpm2_end_auth_session(chip);

1
drivers/char/tpm/tpm2-sessions.c
View File

@ -975,6 +975,7 @@ static int tpm2_load_null(struct tpm_chip *chip, u32 *null_key)
/* Deduce from the name change TPM interference: */
dev_err(&chip->dev, "null key integrity check failed\n");
tpm2_flush_context(chip, tmp_null_key);
rc = -ENODEV;
err:
if (rc) {