github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
3a00c9bc8e
linux/drivers
History
Jaewon Yang f20d61c22b tpm: Make the TPM character devices non-seekable 
The TPM character devices expose a sequential command/response
interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE
enabled.

After a command leaves a response pending, pread(fd, buf, 16, 0x1400)
passes 0x1400 as *off to tpm_common_read(). The transfer length is
bounded by response_length, but the offset is used unchecked when
forming data_buffer + *off. A sufficiently large offset therefore causes
an out-of-bounds heap read through copy_to_user() and, if the copy
succeeds, an out-of-bounds zero-write through the following memset().

Positional I/O does not provide coherent semantics for this interface.
An arbitrary pread offset cannot represent how much of a response has
been consumed sequentially. The write callback always stores a command
at the start of data_buffer, while pwrite() does not update file->f_pos
and can leave the sequential read cursor stale.

Call nonseekable_open() from both open handlers. This removes
FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to
fail with -ESPIPE before reaching the TPM callbacks, and explicitly
marks the files non-seekable. Normal read() and write() continue to use
the existing sequential f_pos cursor, leaving the response state machine
unchanged.

Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:

 - sequential partial reads returned the complete response
 - pread() and preadv() with offset 0x1400 returned -ESPIPE
 - pwrite() and pwritev() with offset zero returned -ESPIPE
 - the pending response remained intact after the rejected operations
 - a subsequent normal command/response cycle completed normally
 - no KASAN report was produced.

Fixes: 9488585b21 ("tpm: add support for partial reads")
Link: https://lore.kernel.org/all/20260710090217.191289-1-yong010301@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Jaewon Yang <yong010301@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2026-07-12 12:52:34 -07:00
..
accel Merge tag 'drm-misc-fixes-2026-07-09' of https://gitlab.freedesktop.org/drm/misc/kernel into drm-fixes 2026-07-10 13:03:15 +10:00
accessibility
acpi ACPI support fixes for 7.2-rc2 2026-07-03 15:13:50 -10:00
amba
android rust_binder: clear freeze listener on node removal 2026-07-03 13:54:10 +02:00
ata ata fixes for 7.2-rc3 2026-07-10 09:17:00 -07:00
atm
auxdisplay Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
base regmap: Fix for v7.2 2026-06-26 10:47:26 -07:00
bcma
block block-7.2-20260710 2026-07-11 09:35:33 -07:00
bluetooth Including fixes from netfilter, Bluetooth and batman-adv. 2026-07-09 08:26:51 -07:00
bus Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cache Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cdrom
cdx Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
char tpm: Make the TPM character devices non-seekable 2026-07-12 12:52:34 -07:00
clk Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
clocksource
comedi
connector
counter Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cpufreq Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cpuidle cpuidle: Allow exit latency to exceed target residency 2026-06-23 14:00:29 +02:00
crypto Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
cxl
dax mm.git review status for mm-hotfixes-stable..mm-stable 2026-06-19 10:14:34 -07:00
dca
devfreq Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
dibs dibs: loopback: validate offset and size in move_data() 2026-07-09 12:44:00 +02:00
dio
dma Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
dma-buf Merge drm/drm-fixes into drm-misc-fixes 2026-06-29 17:58:00 +02:00
dpll Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
edac Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
eisa
extcon Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
firewire Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
firmware Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
fpga Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
fsi Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
fwctl
gnss
gpib Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
gpio gpio: mvebu: free generic chips on unbind 2026-07-08 14:05:11 +02:00
gpu nouveau/vmm: fix another SPT/LPT race 2026-07-10 14:19:23 +10:00
greybus
hid Android/IIO bugfixes for 7.2-rc3 2026-07-12 12:37:28 -07:00
hsi Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hte Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
hv hyperv-next for v7.2-rc1 2026-06-22 08:06:13 -07:00
hwmon Split <linux/mod_devicetable.h> in per subsystem headers 2026-07-02 20:54:26 -10:00
hwspinlock
hwtracing Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
i2c Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
i3c
idle
iio Android/IIO bugfixes for 7.2-rc3 2026-07-12 12:37:28 -07:00
infiniband
input Input updates for v7.2-rc2 2026-07-11 15:42:55 -07:00
interconnect Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
iommu Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ipack
irqchip Misc irqchip driver fixes: 2026-07-05 05:29:41 -10:00
leds Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
macintosh
mailbox Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
mcb
md dm thin metadata: fix superblock refcount leak on snapshot shadow failure 2026-07-11 15:18:51 +02:00
media Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
memory Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
memstick
message
mfd Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
misc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
mmc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
most
mtd Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
mux Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
net Including fixes from netfilter, Bluetooth and batman-adv. 2026-07-09 08:26:51 -07:00
nfc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ntb NTB updates include an EPF bug fix to prevent an invalid unmap during 2026-06-28 07:46:12 -07:00
nubus
nvdimm Updates for the 7.2 release 2026-06-18 16:27:58 -07:00
nvme block-7.2-20260625 2026-06-25 09:56:47 -07:00
nvmem Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
of Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
opp
parisc
parport
pci Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
pcmcia
peci
perf Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
phy Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
pinctrl gpio fixes for v7.2-rc2 2026-07-03 05:38:12 -10:00
platform platform-drivers-x86 for v7.2-2 2026-07-10 09:51:45 -07:00
pmdomain Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
pnp Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
power Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
powercap
pps Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ps3
ptp Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
pwm Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rapidio mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
ras
regulator regulator: core: regulator_lock_two() should test for EDEADLK not EDEADLOCK 2026-07-09 01:41:17 +01:00
remoteproc
resctrl
reset Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
rpmsg rpmsg update for v7.2 2026-06-20 23:31:15 -07:00
rtc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
s390 s390/zcrypt: Remove the empty file 2026-07-08 17:02:47 +02:00
sbus
scsi mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
sh
siox Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
slimbus
soc Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
soundwire Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
spi spi: Fixes for v7.2 2026-07-05 05:24:06 -10:00
spmi Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
ssb
staging staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr() 2026-07-07 13:43:27 +02:00
target
tc
tee
thermal Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
thunderbolt USB/Thunderbolt driver changes for 7.2-rc1 2026-06-22 12:09:47 -07:00
tty TTY/Serial fixes for 7.2-rc3 2026-07-12 12:29:38 -07:00
ufs ufs: core: tracing: Do not dereference pointers in TP_printk() 2026-07-07 10:42:28 -04:00
uio Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
usb USB fixes for 7.2-rc3 2026-07-12 12:12:41 -07:00
vdpa Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
vfio vfio/pci: Expose latched module parameter policy in debugfs 2026-06-29 14:26:31 -06:00
vhost mm.git review status for mm-hotfixes-stable..mm-nonmm-stable 2026-06-21 13:20:19 -07:00
video Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
virt Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
virtio
w1 Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
watchdog Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 2026-07-03 07:38:17 +02:00
xen xenbus: reject unterminated directory replies 2026-07-01 10:01:14 +02:00
zorro
Kconfig
Makefile