linux-stable.git/drivers/char, branch v7.2.6

tpm: st33zp24: Validate locality read result

2026-09-14T11:41:07+00:00

[ Upstream commit 264216889d39df509b9c8045df53529480b0b718 ]

check_locality() treats every nonzero transport return as success. SPI
errors remain negative, while the I2C path can convert a negative write
error through its byte-sized status variable. Either result is nonzero
even though the TPM_ACCESS byte can remain unwritten, so indeterminate
ACTIVE_LOCALITY and VALID bits can falsely report an active locality.

Require recv() to return exactly the requested byte before examining
TPM_ACCESS. Transport errors and short reads now report an inactive
locality, while successful reads retain the existing behavior.

This issue was found by a static analysis checker and confirmed by manual
source review.

Fixes: 251a7b08213a ("TPM: STMicroelectronics ST33 I2C KERNEL 3.x")
Signed-off-by: Ruoyu Wang 
Link: https://lore.kernel.org/r/20260813153032.3951878-2-ruoyuw560@gmail.com
Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Sasha Levin

tpm: st33zp24: Return zero on status read failure

2026-09-14T11:41:07+00:00

[ Upstream commit 8b92687708f5ef980de01c2042dbd76d11f78547 ]

st33zp24_status() ignores the result of the transport read and returns
data even when no byte was received. The I2C transport, for example,
skips i2c_master_recv() when the register-select write is short or fails,
leaving data uninitialized. The resulting stack value can be interpreted
as TPM_STS flags and let status checks complete spuriously.

The status callback cannot propagate a transport error. Return zero
unless recv() reports exactly one byte. With no status bits set, callers
retry or take their existing timeout or error path instead of acting on
an invalid status value.

This issue was found by a static analysis checker and confirmed by manual
source review.

Fixes: 251a7b08213a ("TPM: STMicroelectronics ST33 I2C KERNEL 3.x")
Signed-off-by: Ruoyu Wang 
Link: https://lore.kernel.org/r/20260813153032.3951878-1-ruoyuw560@gmail.com
Reviewed-by: Jarkko Sakkinen 
Signed-off-by: Jarkko Sakkinen 
Signed-off-by: Sasha Levin

hwrng: imx-rngc - Disable clock on registration failure

2026-09-14T11:40:35+00:00

[ Upstream commit 188bb9ad86c3b2d527385328a30c1d9510253202 ]

The RNGC clock is enabled manually before runtime PM is configured. If
devm_hwrng_register() fails, probe returns without disabling the clock.
The devm_pm_runtime_enable() cleanup only disables runtime PM and does not
call imx_rngc_suspend().

Disable the clock before returning from this failure path.

Fixes: 7a96a64e8689 ("hwrng: imx-rngc - add runtime pm")
Signed-off-by: Yuho Choi 
Reviewed-by: Martin Kaiser 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

char: xilinx_hwicap: unregister class on init errors

2026-09-14T11:39:37+00:00

[ Upstream commit e7e12b4cc0f0c3a2782aea084d4215e23f5512b3 ]

hwicap_module_init() registers icap_class before reserving the
character-device region and registering the platform driver.  If either
of those later steps fails, the init path must undo the successful class
registration before returning an error.

Route the chrdev registration failure through a class unwind label, and
let the platform-driver registration failure fall through the existing
chrdev unwind before unregistering the class.  The normal module exit path
is unchanged.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: ef141a0bb0dc ("[POWERPC] Xilinx: hwicap driver")
Co-developed-by: Ijae Kim 
Signed-off-by: Ijae Kim 
Signed-off-by: Myeonghun Pak 
Reviewed-by: Radhey Shyam Pandey 
Link: https://patch.msgid.link/20260623085604.89284-1-mhun512@gmail.com
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

ppdev: prevent overflow when setting port timeout

2026-09-14T11:39:36+00:00

[ Upstream commit 3c0cf801ea2fa40daa5e7d1e6d32adca5ff75ad9 ]

PPSETTIME64 supplies the timeval fields as s64 values, but
pp_set_timeout() narrows tv_usec to int and calculates tv_sec * HZ in a
signed long. Large positive values can therefore be truncated or overflow
and install an unintended timeout.

Keep both fields as s64, reject a non-canonical microsecond value, and
use timespec64_to_jiffies() to cap excessively large timeouts at
MAX_JIFFY_OFFSET. This is a behavior change because both PPSETTIME
ioctls could previously accept values with tv_usec >= USEC_PER_SEC.
The validation follows the precedent set by sock_set_timeout().

Fixes: 3b9ab374a1e6 ("ppdev: convert to y2038 safe")
Signed-off-by: Linmao Li 
Reviewed-by: Arnd Bergmann 
Link: https://patch.msgid.link/20260716013923.19494-1-lilinmao@kylinos.cn
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

tlclk: if sscanf() fails, fall back to 0, not random value

2026-09-14T11:39:36+00:00

[ Upstream commit 75f9481e0479c3faadf4d88baffe84b3d23d5763 ]

If sscanf(IN, FMT, &OUT) fails, OUT may be unchanged.
So if OUT was never initialized, it may be still uninitialized memory.
To prevent such, initialize OUT=0 first.

Fixes: 648bf4fb21f5 ("[PATCH] tlclk driver update")
Fixes: 1a80ba882730 ("[PATCH] Telecom Clock Driver for MPCBL0010 ATCA computer blade")
Signed-off-by: Alexander A. Klimov 
Link: https://patch.msgid.link/20260526061321.6123-4-grandmaster@al2klimov.de
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

hwrng: ks-sa - Fix runtime PM cleanup on registration failure

2026-09-14T11:39:26+00:00

[ Upstream commit 1c17b601fafb09c9ec074fd097737d20eafe7d63 ]

ks_sa_rng_probe() enables runtime PM and resumes the device before
registering the hwrng. If devm_hwrng_register() fails, probe returns
without dropping the runtime PM usage count or disabling runtime PM.

Unwind the runtime PM state on the registration failure path, matching
the cleanup done by remove().

Fixes: eb428ee0e3ca ("hwrng: ks-sa - add hw_random driver")
Signed-off-by: Yuho Choi 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

hwrng: omap - Fix probe error path cleanup

2026-09-14T11:39:14+00:00

[ Upstream commit f8c24e6899e263073fbbeb07fadc1af85ec492f5 ]

omap_rng_probe() enables runtime PM before acquiring and enabling the
functional clocks.  Several later error paths returned or unwound without
undoing all state acquired so far.

If pm_runtime_resume_and_get() failed, the driver returned through the
generic ioremap error label and left runtime PM enabled.  If either clock
lookup returned -EPROBE_DEFER, the function returned directly and skipped
the runtime PM cleanup; the register clock defer path could also leave the
already enabled functional clock prepared.

Route these failures through the existing unwind labels so each path only
undoes resources that were acquired successfully.  Keep the resume failure
path limited to pm_runtime_disable(), and use the later labels only after
the runtime PM usage count or clocks have been acquired.

This issue was identified during our ongoing static-analysis research while
reviewing kernel code.

Fixes: 61dc0a446e5d ("hwrng: omap - Fix assumption that runtime_get_sync will always succeed")
Fixes: 43ec540e6f9b ("hwrng: omap - move clock related code to omap_rng_probe()")
Fixes: b166be004491 ("hwrng: omap - Fix clock resource by adding a register clock")
Co-developed-by: Ijae Kim 
Signed-off-by: Ijae Kim 
Signed-off-by: Myeonghun Pak 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

hwrng: xilinx-trng - propagate timeout before any data is read

2026-09-14T11:39:14+00:00

[ Upstream commit ba088974419326daf46c5dc03e2cf6ab6ab701f7 ]

xtrng_readblock32() polls for 16-byte chunks but returns the number of
bytes read even when the first poll times out. Its caller then treats a
zero return as a short successful read, and partial reads for full
32-byte blocks can make the tail copy use a fixed block offset rather
than the amount already produced.

Return the poll error when no data has been read, preserve partial
positive returns after some data is available, stop the generator on all
collection exits, and append tail bytes at the current output count.

Fixes: 8979744aca80 ("crypto: xilinx - Add TRNG driver for Versal")
Signed-off-by: Pengpeng Hou 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin

hwrng: core - fix rng list on registration error

2026-09-14T11:39:13+00:00

[ Upstream commit 3a5834db2b1ce25649f330e78efe1ccde78967fd ]

hwrng_register(rng) does the following:

1. Checks if rng has name and read methods set
2. Checks if the name already exists
3. Adds rng to global rng_list
4. May try to set rng to current_rng

If step 4 fails, it returns an error. However, it does not remove the
rng from rng_list, causing a dangling reference which can result in
use-after-free if the caller frees rng, since registration failed.

Add a list_del_init() cleanup step.

Fixes: 2bbb6983887f ("hwrng: use rng source with best quality")
Signed-off-by: Manos Pitsidianakis 
Signed-off-by: Herbert Xu 
Signed-off-by: Sasha Levin