* [PATCH] tpm: Fix heap buffer overflow in tpm_transmit_cmd()
@ 2026-09-01 6:28 Jiangshan Yi
2026-09-01 13:47 ` Jarkko Sakkinen
0 siblings, 1 reply; 2+ messages in thread
From: Jiangshan Yi @ 2026-09-01 6:28 UTC (permalink / raw)
To: peterhuewe, jarkko
Cc: jgg, ross.philipson, stefanb, linux-integrity, linux-kernel,
13667453960, Jiangshan Yi, stable
struct tpm_buf now uses an embedded flexible array for data, which is
6 bytes shorter than TPM_BUFSIZE due to the struct header. But
tpm_transmit_cmd() still passes PAGE_SIZE to tpm_transmit(), and after
clamping to TPM_BUFSIZE in tpm_try_transmit(), chip->ops->recv() can
write past the end of data[] by 6 bytes.
Pass buf->capacity to tpm_transmit() instead.
Fixes: 3d9e043dab0a ("tpm-buf: Memory-safe allocations")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
---
drivers/char/tpm/tpm-interface.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index f745a098908b..1ccdbde98b69 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -268,7 +268,7 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf,
int err;
ssize_t len;
- len = tpm_transmit(chip, buf->data, PAGE_SIZE);
+ len = tpm_transmit(chip, buf->data, buf->capacity);
if (len < 0)
return len;
--
2.25.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] tpm: Fix heap buffer overflow in tpm_transmit_cmd()
2026-09-01 6:28 [PATCH] tpm: Fix heap buffer overflow in tpm_transmit_cmd() Jiangshan Yi
@ 2026-09-01 13:47 ` Jarkko Sakkinen
0 siblings, 0 replies; 2+ messages in thread
From: Jarkko Sakkinen @ 2026-09-01 13:47 UTC (permalink / raw)
To: Jiangshan Yi
Cc: peterhuewe, jgg, ross.philipson, stefanb, linux-integrity,
linux-kernel, 13667453960, stable
On Tue, Sep 01, 2026 at 02:28:50PM +0800, Jiangshan Yi wrote:
> struct tpm_buf now uses an embedded flexible array for data, which is
> 6 bytes shorter than TPM_BUFSIZE due to the struct header. But
> tpm_transmit_cmd() still passes PAGE_SIZE to tpm_transmit(), and after
> clamping to TPM_BUFSIZE in tpm_try_transmit(), chip->ops->recv() can
> write past the end of data[] by 6 bytes.
>
> Pass buf->capacity to tpm_transmit() instead.
>
> Fixes: 3d9e043dab0a ("tpm-buf: Memory-safe allocations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
> ---
> drivers/char/tpm/tpm-interface.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
> index f745a098908b..1ccdbde98b69 100644
> --- a/drivers/char/tpm/tpm-interface.c
> +++ b/drivers/char/tpm/tpm-interface.c
> @@ -268,7 +268,7 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf,
> int err;
> ssize_t len;
>
> - len = tpm_transmit(chip, buf->data, PAGE_SIZE);
> + len = tpm_transmit(chip, buf->data, buf->capacity);
> if (len < 0)
> return len;
>
> --
> 2.25.1
>
Thank you good catch!
I'll apply this and put to rc2 PR.
BR, Jarkko
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-09-01 13:47 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-01 6:28 [PATCH] tpm: Fix heap buffer overflow in tpm_transmit_cmd() Jiangshan Yi
2026-09-01 13:47 ` Jarkko Sakkinen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox