mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-08-09 06:14:34 +02:00
Jaewon YangandLinus Torvalds
f20d61c22b
The TPM character devices expose a sequential command/response
interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE
enabled.
After a command leaves a response pending, pread(fd, buf, 16, 0x1400)
passes 0x1400 as *off to tpm_common_read(). The transfer length is
bounded by response_length, but the offset is used unchecked when
forming data_buffer + *off. A sufficiently large offset therefore causes
an out-of-bounds heap read through copy_to_user() and, if the copy
succeeds, an out-of-bounds zero-write through the following memset().
Positional I/O does not provide coherent semantics for this interface.
An arbitrary pread offset cannot represent how much of a response has
been consumed sequentially. The write callback always stores a command
at the start of data_buffer, while pwrite() does not update file->f_pos
and can leave the sequential read cursor stale.
Call nonseekable_open() from both open handlers. This removes
FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to
fail with -ESPIPE before reaching the TPM callbacks, and explicitly
marks the files non-seekable. Normal read() and write() continue to use
the existing sequential f_pos cursor, leaving the response state machine
unchanged.
Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:
- sequential partial reads returned the complete response
- pread() and preadv() with offset 0x1400 returned -ESPIPE
- pwrite() and pwritev() with offset zero returned -ESPIPE
- the pending response remained intact after the rejected operations
- a subsequent normal command/response cycle completed normally
- no KASAN report was produced.
Fixes: 9488585b21 ("tpm: add support for partial reads")
Link: https://lore.kernel.org/all/20260710090217.191289-1-yong010301@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Jaewon Yang <yong010301@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
55 lines
1.2 KiB
C
55 lines
1.2 KiB
C
// SPDX-License-Identifier: GPL-2.0-only
|
|
/*
|
|
* Copyright (C) 2017 James.Bottomley@HansenPartnership.com
|
|
*/
|
|
#include <linux/slab.h>
|
|
#include "tpm-dev.h"
|
|
|
|
struct tpmrm_priv {
|
|
struct file_priv priv;
|
|
struct tpm_space space;
|
|
};
|
|
|
|
static int tpmrm_open(struct inode *inode, struct file *file)
|
|
{
|
|
struct tpm_chip *chip;
|
|
struct tpmrm_priv *priv;
|
|
int rc;
|
|
|
|
chip = container_of(inode->i_cdev, struct tpm_chip, cdevs);
|
|
priv = kzalloc_obj(*priv);
|
|
if (priv == NULL)
|
|
return -ENOMEM;
|
|
|
|
rc = tpm2_init_space(&priv->space, TPM2_SPACE_BUFFER_SIZE);
|
|
if (rc) {
|
|
kfree(priv);
|
|
return -ENOMEM;
|
|
}
|
|
|
|
tpm_common_open(file, chip, &priv->priv, &priv->space);
|
|
|
|
return nonseekable_open(inode, file);
|
|
}
|
|
|
|
static int tpmrm_release(struct inode *inode, struct file *file)
|
|
{
|
|
struct file_priv *fpriv = file->private_data;
|
|
struct tpmrm_priv *priv = container_of(fpriv, struct tpmrm_priv, priv);
|
|
|
|
tpm_common_release(file, fpriv);
|
|
tpm2_del_space(fpriv->chip, &priv->space);
|
|
kfree(priv);
|
|
|
|
return 0;
|
|
}
|
|
|
|
const struct file_operations tpmrm_fops = {
|
|
.owner = THIS_MODULE,
|
|
.open = tpmrm_open,
|
|
.read = tpm_common_read,
|
|
.write = tpm_common_write,
|
|
.poll = tpm_common_poll,
|
|
.release = tpmrm_release,
|
|
};
|