mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Jaewon YangandLinus Torvalds
f20d61c22b
The TPM character devices expose a sequential command/response
interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE
enabled.
After a command leaves a response pending, pread(fd, buf, 16, 0x1400)
passes 0x1400 as *off to tpm_common_read(). The transfer length is
bounded by response_length, but the offset is used unchecked when
forming data_buffer + *off. A sufficiently large offset therefore causes
an out-of-bounds heap read through copy_to_user() and, if the copy
succeeds, an out-of-bounds zero-write through the following memset().
Positional I/O does not provide coherent semantics for this interface.
An arbitrary pread offset cannot represent how much of a response has
been consumed sequentially. The write callback always stores a command
at the start of data_buffer, while pwrite() does not update file->f_pos
and can leave the sequential read cursor stale.
Call nonseekable_open() from both open handlers. This removes
FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to
fail with -ESPIPE before reaching the TPM callbacks, and explicitly
marks the files non-seekable. Normal read() and write() continue to use
the existing sequential f_pos cursor, leaving the response state machine
unchanged.
Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:
- sequential partial reads returned the complete response
- pread() and preadv() with offset 0x1400 returned -ESPIPE
- pwrite() and pwritev() with offset zero returned -ESPIPE
- the pending response remained intact after the rejected operations
- a subsequent normal command/response cycle completed normally
- no KASAN report was produced.
Fixes: 9488585b21 ("tpm: add support for partial reads")
Link: https://lore.kernel.org/all/20260710090217.191289-1-yong010301@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Jaewon Yang <yong010301@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
68 lines
1.5 KiB
C
68 lines
1.5 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Copyright (C) 2004 IBM Corporation
|
|
* Authors:
|
|
* Leendert van Doorn <leendert@watson.ibm.com>
|
|
* Dave Safford <safford@watson.ibm.com>
|
|
* Reiner Sailer <sailer@watson.ibm.com>
|
|
* Kylene Hall <kjhall@us.ibm.com>
|
|
*
|
|
* Copyright (C) 2013 Obsidian Research Corp
|
|
* Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
|
|
*
|
|
* Device file system interface to the TPM
|
|
*/
|
|
#include <linux/slab.h>
|
|
#include "tpm-dev.h"
|
|
|
|
static int tpm_open(struct inode *inode, struct file *file)
|
|
{
|
|
struct tpm_chip *chip;
|
|
struct file_priv *priv;
|
|
|
|
chip = container_of(inode->i_cdev, struct tpm_chip, cdev);
|
|
|
|
/* It's assured that the chip will be opened just once,
|
|
* by the check of is_open variable, which is protected
|
|
* by driver_lock. */
|
|
if (test_and_set_bit(0, &chip->is_open)) {
|
|
dev_dbg(&chip->dev, "Another process owns this TPM\n");
|
|
return -EBUSY;
|
|
}
|
|
|
|
priv = kzalloc_obj(*priv);
|
|
if (priv == NULL)
|
|
goto out;
|
|
|
|
tpm_common_open(file, chip, priv, NULL);
|
|
|
|
return nonseekable_open(inode, file);
|
|
|
|
out:
|
|
clear_bit(0, &chip->is_open);
|
|
return -ENOMEM;
|
|
}
|
|
|
|
/*
|
|
* Called on file close
|
|
*/
|
|
static int tpm_release(struct inode *inode, struct file *file)
|
|
{
|
|
struct file_priv *priv = file->private_data;
|
|
|
|
tpm_common_release(file, priv);
|
|
clear_bit(0, &priv->chip->is_open);
|
|
kfree(priv);
|
|
|
|
return 0;
|
|
}
|
|
|
|
const struct file_operations tpm_fops = {
|
|
.owner = THIS_MODULE,
|
|
.open = tpm_open,
|
|
.read = tpm_common_read,
|
|
.write = tpm_common_write,
|
|
.poll = tpm_common_poll,
|
|
.release = tpm_release,
|
|
};
|