kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-08 18:57:22 +00:00
Code Issues Releases Packages Activity
linux/drivers/char/tpm
History
Jarkko Sakkinen 47e676ce4d tpm2-sessions: Fix out of range indexing in name_size 
commit 6e9722e9a7 upstream.

'name_size' does not have any range checks, and it just directly indexes
with TPM_ALG_ID, which could lead into memory corruption at worst.

Address the issue by only processing known values and returning -EINVAL for
unrecognized values.

Make also 'tpm_buf_append_name' and 'tpm_buf_fill_hmac_session' fallible so
that errors are detected before causing any spurious TPM traffic.

End also the authorization session on failure in both of the functions, as
the session state would be then by definition corrupted.

Cc: stable@vger.kernel.org # v6.10+
Fixes: 1085b8276b ("tpm: Add the rest of the session HMAC API")
Reviewed-by: Jonathan McDowell <noodles@meta.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-01-17 16:31:29 +01:00
..
eventlog tpm: Change to kvalloc() in eventlog/acpi.c 2025-02-17 10:05:30 +01:00
st33zp24 tpm: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-09-17 18:56:37 +03:00
Kconfig tpm: Disable TPM2_TCG_HMAC by default 2025-10-15 12:00:20 +02:00
Makefile tpm: Address !chip->auth in tpm_buf_append_name() 2024-07-05 02:12:27 +03:00
tpm-buf.c char: tpm: tpm-buf: Add sanity check fallback in read helpers 2025-06-04 14:43:53 +02:00
tpm-chip.c tpm: Cap the number of PCR banks 2026-01-08 10:14:15 +01:00
tpm-dev-common.c tpm: Lazily flush the auth session 2024-10-29 00:46:20 +02:00
tpm-dev.c [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
tpm-dev.h tpm: Handle negative priv->response_len in tpm_common_read() 2020-01-08 18:11:09 +02:00
tpm-interface.c tpm: do not start chip while suspended 2025-04-20 10:15:43 +02:00
tpm-sysfs.c tpm: add the null key name as a sysfs export 2024-05-09 22:30:52 +03:00
tpm.h tpm: Switch to new Intel CPU model defines 2024-06-05 04:55:04 +03:00
tpm1-cmd.c tpm: Cap the number of PCR banks 2026-01-08 10:14:15 +01:00
tpm2-cmd.c tpm2-sessions: Fix out of range indexing in name_size 2026-01-17 16:31:29 +01:00
tpm2-sessions.c tpm2-sessions: Fix out of range indexing in name_size 2026-01-17 16:31:29 +01:00
tpm2-space.c move asm/unaligned.h to linux/unaligned.h 2024-10-02 17:23:23 -04:00
tpm_atmel.c Normalise "name (ad@dr)" MODULE_AUTHORs to "name <ad@dr>" 2024-03-06 13:07:39 -08:00
tpm_atmel.h tpm: atmel: Add explicit include for of.h 2023-04-06 20:36:27 +02:00
tpm_crb.c tpm: Enable hwrng only for Pluton on AMD CPUs 2023-09-04 21:57:59 +03:00
tpm_ftpm_tee.c tpm/tpm_ftpm_tee: fix all kernel-doc warnings 2024-03-12 00:26:05 +02:00
tpm_ftpm_tee.h tpm/tpm_ftpm_tee: A driver for firmware TPM running inside TEE 2019-09-02 17:08:35 +03:00
tpm_i2c_atmel.c tpm: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-09-17 18:56:37 +03:00
tpm_i2c_infineon.c tpm: Switch i2c drivers back to use .probe() 2023-07-28 18:12:40 +00:00
tpm_i2c_nuvoton.c Normalise "name (ad@dr)" MODULE_AUTHORs to "name <ad@dr>" 2024-03-06 13:07:39 -08:00
tpm_ibmvtpm.c tpm: ibmvtpm: Call tpm2_sessions_init() to initialize session support 2024-08-27 21:11:44 +03:00
tpm_ibmvtpm.h tpm: ibmvtpm: Avoid error message when process gets signal while waiting 2021-08-23 19:55:42 +03:00
tpm_infineon.c char: tpm: Keep TPM_INF_IO_PORT define for HAS_IOPORT=n 2024-05-09 22:30:50 +03:00
tpm_nsc.c Normalise "name (ad@dr)" MODULE_AUTHORs to "name <ad@dr>" 2024-03-06 13:07:39 -08:00
tpm_ppi.c char: move from strlcpy with unused retval to strscpy 2022-10-05 00:25:56 +03:00
tpm_tis.c - Kuan-Wei Chiu has developed the well-named series "lib min_heap: Min 2024-03-14 18:03:09 -07:00
tpm_tis_core.c tpm_tis: Fix incorrect arguments in tpm_tis_probe_irq_single 2025-10-19 16:33:43 +02:00
tpm_tis_core.h tpm: tis: Double the timeout B to 4s 2025-05-22 14:29:36 +02:00
tpm_tis_i2c.c tpm: Drop explicit initialization of struct i2c_device_id::driver_data to 0 2024-09-17 18:56:37 +03:00
tpm_tis_i2c_cr50.c tpm: cr50: fix kernel-doc warning and spelling 2024-01-09 11:12:27 +02:00
tpm_tis_spi.h tpm: Remove read16/read32/write32 calls from tpm_tis_phy_ops 2022-05-23 18:47:49 +03:00
tpm_tis_spi_cr50.c tpm: Remove read16/read32/write32 calls from tpm_tis_phy_ops 2022-05-23 18:47:49 +03:00
tpm_tis_spi_main.c tpm_tis_spi: add missing attpm20p SPI device ID entry 2024-07-01 15:50:02 +00:00
tpm_tis_synquacer.c Devicetree include cleanups for v6.6: 2023-08-30 17:04:28 -07:00
tpm_vtpm_proxy.c [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
tpmrm-dev.c [tree-wide] finally take no_llseek out 2024-09-27 08:18:43 -07:00
xen-tpmfront.c xen: make remove callback of xen driver void returned 2022-12-15 16:06:10 +01:00