The TPM character devices expose a sequential command/response
interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE
enabled.

After a command leaves a response pending, pread(fd, buf, 16, 0x1400)
passes 0x1400 as *off to tpm_common_read(). The transfer length is
bounded by response_length, but the offset is used unchecked when
forming data_buffer + *off. A sufficiently large offset therefore causes
an out-of-bounds heap read through copy_to_user() and, if the copy
succeeds, an out-of-bounds zero-write through the following memset().

Positional I/O does not provide coherent semantics for this interface.
An arbitrary pread offset cannot represent how much of a response has
been consumed sequentially. The write callback always stores a command
at the start of data_buffer, while pwrite() does not update file->f_pos
and can leave the sequential read cursor stale.

Call nonseekable_open() from both open handlers. This removes
FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to
fail with -ESPIPE before reaching the TPM callbacks, and explicitly
marks the files non-seekable. Normal read() and write() continue to use
the existing sequential f_pos cursor, leaving the response state machine
unchanged.

Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:

 - sequential partial reads returned the complete response
 - pread() and preadv() with offset 0x1400 returned -ESPIPE
 - pwrite() and pwritev() with offset zero returned -ESPIPE
 - the pending response remained intact after the rejected operations
 - a subsequent normal command/response cycle completed normally
 - no KASAN report was produced.

Fixes: 9488585b21be ("tpm: add support for partial reads")
Link: https://lore.kernel.org/all/20260710090217.191289-1-yong010301@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Jaewon Yang <yong010301@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull staging driver fixes from Greg KH:
 "Here are some staging driver fixes for 7.2-rc3 for some reported bugs
  in the vme_user and rtl8723bs drivers. These include:

   - many rtl8723bs OOB fixes for when connecting to "bad" wifi hosts

   - vme_user bugfixes to correctly validate some user-provided data

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'staging-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: rtl8723bs: fix OOB reads in rtw_get_sec_ie(), rtw_get_wapi_ie(), and rtw_get_wps_attr()
  staging: rtl8723bs: fix OOB reads in is_ap_in_tkip() IE loop
  staging: rtl8723bs: fix OOB read in OnAssocRsp() IE loop
  staging: rtl8723bs: fix OOB write in HT_caps_handler()
  staging: rtl8723bs: fix heap buffer overflow in rtw_cfg80211_set_wpa_ie()
  staging: rtl8723bs: fix OOB reads in IE loops in issue_assocreq() and join_cmd_hdl()
  staging: rtl8723bs: fix OOB read in update_beacon_info() IE loop
  staging: rtl8723bs: fix WEP length underflow and OOB read in OnAuth()
  staging: vme_user: fix location monitor leak in tsi148 bridge
  staging: vme_user: fix location monitor leak in fake bridge
  staging: vme_user: bound slave read/write to the kern_buf size
  staging: rtl8723bs: don't drop short TX frames in _rtw_pktfile_read()

Pull Android/IIO fixes from Greg KH:
 "Here is a set of bugfixes for 7.2-rc3 that resolve a bunch of reported
  issues in just the binder and iio codebases. Included in here are:

   - binder driver bugfixes for both the rust and c versions for
     reported problems

   - lots and lots of iio driver bugfixes for lots of reported issues
     (including a hid sensor driver bugfix)

  Full details are in the shortlog, all of these have been in linux-next
  with no reported issues"

* tag 'char-misc-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (36 commits)
  iio: event: Fix event FIFO reset race
  iio: imu: inv_icm42600: fix timestamp clock period by using lower value
  iio: light: al3010: fix incorrect scale for the highest gain range
  iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for()
  iio: light: tsl2591: return actual error from probe IRQ failure
  iio: imu: inv_icm42600: fix timestamping by limiting FIFO reading
  iio: imu: st_lsm6dsx: deselect shub page before reading whoami
  rust_binder: clear freeze listener on node removal
  rust_binder: reject context manager self-transaction
  rust_binder: use a u64 stride when cleaning up the offsets array
  binder: fix UAF in binder_free_transaction()
  binder: fix UAF in binder_thread_release()
  rust_binder: synchronize Rust Binder stats with freeze commands
  binder: cache secctx size before release zeroes it
  rust_binder: fix BINDER_GET_EXTENDED_ERROR
  iio: adc: ad7779: add missing 'select IIO_TRIGGERED_BUFFER' to Kconfig
  iio: adc: ad4130: add missing `select IIO_TRIGGERED_BUFFER` to Kconfig
  iio: adc: ti-ads124s08: Return reset GPIO lookup errors
  iio: temperature: Build mlx90635 with CONFIG_MLX90635
  iio: light: al3320a: add missing REGMAP_I2C to Kconfig
  ...

Pull tty/serial fixes from Greg KH:
 "Here are some small tty/serial/vt fixes for 7.2-rc3 that resolve some
  reported problems. Included in here are:

   - vt spurious modifier issue that showed up in -rc1 (reported a
     bunch)

   - 8250 driver bugfixes

   - msm serial driver bugfix

   - max310x serial driver bugfix

  All of these have been in linux-next with no reported issues"

* tag 'tty-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: 8250: Ignore flow control on suspend/resume with no_console_suspend
  serial: 8250_mid: Disable DMA for selected platforms
  serial: 8250_omap: clear rx_running on zero-length DMA completes
  vt: fix spurious modifier in CSI/cursor key sequences
  serial: msm: Disable DMA for kernel console UART
  serial: max310x: implement gpio_chip::get_direction()

Pull USB fixes from Greg KH:
 "Here are a number of small USB driver fixes for many reported issues.
  Included in here are:

   - usb serial driver corruption and use-after-free fixes

   - usb gadget rndis bugfixes for malicious/buggy host connections

   - typec driver fixes for a load of different tiny reported issues

   - typec mux driver revert for a broken patch in -rc1

   - usb gadget driver fixes for many different reported problems

   - new usb device quirks added

   - usbip tool fixes and some core usbip fixes as well

   - dwc3 driver fixes for minor issues

   - xhci driver fixes for reported problems

   - lots of other tiny usb driver fixes for many tiny issues

  All of these have been in linux-next with no reported issues"

* tag 'usb-7.2-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (56 commits)
  USB: core: ratelimit cabling message
  usb: misc: usbio: fix disconnect UAF in client teardown
  Revert "usb: typec: mux: avoid duplicated mux switches"
  USB: chaoskey: Fix slab-use-after-free in chaoskey_release()
  usb: ucsi: huawei_gaokun: move typec_altmode off stack
  usb: typec: tcpci_rt1711h: unregister TCPCI port with devres
  usb: typec: tcpm: Fix VDM type for Enter Mode commands
  usb: typec: ucsi: cancel pending work on system suspend
  usb: typec: class: drop PD lookup reference
  usb: typec: ps883x: Fix DP+USB3 configuration
  usb: xhci: Fix sleep in atomic context in xhci_free_streams()
  xhci: sideband: fix ring sg table pages leak
  usb: gadget: udc: Fix use-after-free in gadget_match_driver
  usb: dwc3: run gadget disconnect from sleepable suspend context
  usb: sl811-hcd: disable controller wakeup on remove
  usb: typec: anx7411: use devm_pm_runtime_enable()
  usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup()
  USB: misc: uss720: unregister parport on probe failure
  usb: gadget: function: rndis: add length check for header
  usb: gadget: function: rndis: add length check to response query
  ...

Pull s390 fixes from Vasily Gorbik:

 - Fix missing array_index_nospec() call in diag310 memory topology code
   to prevent speculative execution with a user controlled array index

 - Fix get_align_mask() return type to match vm_unmapped_area_info
   align_mask, avoiding possible truncation for future larger masks

 - Remove empty zcrypt CEX2 files left over after CEX2 and CEX3 driver
   removal

 - Add build salt to the vDSO so it gets a unique build id, similar to
   the kernel and modules

* tag 's390-7.2-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390: Add build salt to the vDSO
  s390/zcrypt: Remove the empty file
  s390/mm: Fix type mismatch in get_align_mask().
  s390/diag: Add missing array_index_nospec() call to memtop_get_page_count()

Pull tracing fixes from Steven Rostedt:

 - Free field in error path of synthetic event parse

   In __create_synth_event() the field was allocated but was not freed
   in the error path

 - Fix ring_buffer_event_length() on 8 byte aligned architectures

   On architectures with CONFIG_HAVE_64BIT_ALIGNED_ACCESS set to y, the
   ring_buffer_event_length() may return the wrong size. This is because
   archs with that config set will always use the "big event meta
   header" as that is 8 bytes keeping the payload 8 bytes aligned, even
   when a 4 byte header could hold the size of the event

   But ring_buffer_event_length() doesn't take this into account and
   only subtracts 4 bytes for the meta header in the length when it
   should have subtracted 8 bytes

 - Have osnoise wait for a full rcu synchronization on unregister

   osnoise_unregister_instance() used to call synchronize_rcu() before
   freeing its copy of the instance but was switched to kfree_rcu(). The
   osniose tracer has code that traverses the instances that it uses,
   and inst is just a pointer to that instance. By using kfree_rcu()
   instead of synchronize_rcu(), the instance that the inst pointer is
   pointing to can be freed while the osnoise code is still referencing
   it

   That is, a rmdir on an instance first unregisters the tracer. When
   the unregister finishes, the rmdir expects that the tracer is
   finished with the instance that it is using. By putting back the
   synchronize_rcu() in osnoise_unregister_instance() the unregistering
   of osnoise will now return when all the users of the instance have
   finished

 - Remove an unused setting of "ret" in tracing_set_tracer()

 - Fix ring_buffer_read_page() copying events

   The commit that changed ring_buffer_read_page() to show dropped
   events from the buffer itself, split the "commit" variable between
   the commit value (with flags) and "size" that holds the size of the
   sub-buffer. A cut and paste error changed the test of the reading
   from checking the size of the buffer to the size of the event causing
   reads to only read one event at a time

 - Make tracepoint_printk a static variable

   When the tracing sysctl knobs were move from sysctl.c to trace.c, the
   variable tracepoint_printk no longer needed to be global. Make it
   static

 - Fix some typos

 - Fix NULL pointer dereference in func_set_flag()

   The flags update of the function tracer first checks if the value of
   the flag is the same and exits if they are, and then it checks if the
   current tracer is the function tracer and exits if it isn't. The
   problem is that these checks need to be in a reversed order, as if
   the tracer isn't the function tracer, then the flag being checked may
   not exist. Reverse the order of these checks

 - Fix ufs core trace events to not dereference a pointer in TP_printk()

   The TP_printk() part of the TRACE_EVENT() macro is called when the
   user reads the "trace" file. This can be seconds, minutes, hours,
   days, weeks, and even months after the data was recorded into the
   ring buffer. Thus, saving a pointer to an object into the ring buffer
   and then dereferencing it from TP_printk() can cause harm as the
   object the pointer is pointing to may no longer exist

   Fix all the trace events in ufs core to save the device name in the
   ring buffer instead of dereferencing the device descriptor from
   TP_printk()

 - Prevent out-of-bound reads in glob matching of trace events

   The filter logic of events allows simple glob logic to add wild cards
   to filter on strings. But some events have fields that may not have a
   terminating 'nul' character. This may cause the glob matching to go
   beyond the string. Change the logic to always pass in the length of
   the field that is being matched

 - Add no-rcu-check version of trace_##event##_enabled()

   The trace_##event##_enabled() usually wraps trace events to do extra
   work that is only needed when the trace event is enabled. But this
   can hide events that are placed in locations where RCU is not
   watching, and can make lockdep not see these bugs when the event is
   not enabled

   The trace_##event##_enabled() was updated to always test to make sure
   RCU is watching to catch locations that may call events without RCU
   being active

   This caused a false positive for the irq_disabled() and related
   events. As that use trace_irq_disabled_enabled() to force RCU to be
   watching when the event is enabled via the ct_irq_enter() function,
   calls the event, and then calls ct_irq_exit() to put RCU back to its
   original state

   The trace_irq_disabled_enabled() should not trigger a warning when
   RCU is not watching because the code within its block handles the
   case properly. Make a __trace_##event##_enabled() version for this
   event to use that doesn't check RCU is watching as it handles the
   case when it isn't

 - Fix use-after-free in user_event_mm_dup()

   When the enabler is removed from the link list, it is freed
   immediately. But it is protected via RCU and needs to be freed after
   an RCU grace period. Use queue_rcu_work() so that the event_mutex can
   also be taken as user_event_put() takes the mutex on the last
   reference is released

 - Free type string in error path of parse_synth_field()

   There's an error path in parse_synth_field() where the allocated type
   string is not freed

 - Add selftest that tests deferred event teardown

 - Fix leak in error path of trace_remote_alloc_buffer()

   If page allocation fails, the desc->nr_cpus is not incremented for
   the current CPU and the allocations done for it are not freed

 - Fix allocation length in trace_remote_alloc_buffer()

   The logic to calculate the struct_len was doing a double count and
   setting the value too large. Calculate the size upfront to fix the
   error and simplify the logic

 - Fix sparse CPU masks in ring_buffer_desc()

   If there are sparse CPUs (gaps in the numbering), the
   ring_buffer_desc() will fail as it tests the CPU number against the
   number of CPUs that are used

* tag 'trace-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Allow sparse CPU masks in ring_buffer_desc()
  tracing/remotes: Fix struct_len in trace_remote_alloc_buffer()
  tracing/remotes: Fix leak in trace_remote_alloc_buffer() error path
  selftests/user_events: Wait for deferred event teardown after unregister
  tracing/synthetic: Free type string on error path
  tracing/user_events: Fix use-after-free in user_event_mm_dup()
  tracing: Add a no-rcu-check version of trace_##event##_enabled()
  tracing: Prevent out-of-bounds read in glob matching
  ufs: core: tracing: Do not dereference pointers in TP_printk()
  tracing: Fix NULL pointer dereference in func_set_flag()
  samples: ftrace: Fix typos in benchmark comment
  tracing: Make tracepoint_printk static as not exported
  ring-buffer: Fix ring_buffer_read_page() copying only one event per page
  tracing: Remove unused ret assignment in tracing_set_tracer()
  tracing/osnoise: Call synchronize_rcu() when unregistering
  ring-buffer: Fix event length with forced 8-byte alignment
  tracing/synthetic: Free pending field on error path

Pull input fixes from Dmitry Torokhov:

 - fix MELFAS MMS114 touchscreen driver to reject invalid touch IDs and
   avoid multi-touch slot corruption

 - fix a crash in the Sega Dreamcast (Maple) mouse driver when opening
   the device, caused by missing driver data

 - fixes for Maple drivers (keyboard, mouse, joystick) to properly order
   setting driver data and device registration to avoid races

* tag 'input-for-v7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: mms114 - fix multi-touch slot corruption
  Input: maple_keyb - set driver data before registering input device
  Input: maplecontrol - set driver data before registering input device
  Input: maplemouse - set driver data before registering input device
  Input: maplemouse - fix NULL pointer dereference in open()

Pull device mapper fixes from Mikulas Patocka:

 - dm-log: fix overflow on 32-bit machines

 - dm-era: fix out of bounds memory access; fix crashes on invalid args

 - dm-verity: fix buffer overflow in forward error correction

 - dm-thin: fix misbehavior on I/O failures

 - dm-pcache: fix NULL pointer dereference on invalid arguments

 - dm-inlinecrypt: fix memory leak on error handling

 - dm-integrity: fix ignoring the 'fix_hmac' option on device open

 - dm: don't store the keyring in memory for a long term

 - 12 miscellaneous fixes for bugs found by Claude Opus 4.6

* tag 'for-7.2/dm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: (23 commits)
  dm thin metadata: fix superblock refcount leak on snapshot shadow failure
  dm-stats: fix dm_jiffies_to_msec64
  dm-stats: fix merge accounting
  dm-bufio: fix wrong count calculation in dm_bufio_issue_discard
  dm-verity: make error counter atomic
  dm-verity: increase sprintf buffer size
  dm-verity: fix a possible NULL pointer dereference
  dm-verity: avoid double increment of &use_bh_wq_enabled
  dm-ioctl: fix a possible overflow in list_version_get_info
  dm_early_create: fix freeing used table on dm_resume failure
  dm-integrity: fix a bug if the bio is out of limits
  dm-integrity: don't increment hash_offset twice
  dm-integrity: fix leaking uninitialized kernel memory
  dm-integrity: fix the 'fix_hmac' option
  dm era: fix error code propagation in era_ctr()
  dm era: fix NULL pointer dereference in metadata_open()
  dm: avoid leaking the caller's thread keyring via the table device file
  dm-inlinecrypt: Fix an error handling path in inlinecrypt_ctr()
  dm-pcache: reject option groups without values
  dm thin metadata: fix metadata snapshot consistency on commit failure
  ...

Pull block fixes from Jens Axboe:

 - Limit blk_hctx_poll() to one jiffy. Prevents buggy drivers from
   spinning for too long, hence triggering a stalled RCU read section
   warning

 - Avoid a potential deadlock on zone revalidation failure, which could
   otherwise trigger a lockdep circular locking splat during a SCSI disk
   rescan

 - Remove a redundant GD_NEED_PART_SCAN set in add_disk_final()

 - Make writes to queue/wbt_lat_usec honor the WBT enable state

 - ublk fix to snapshot the batch commands before preparing IO, so that
   userspace can't change an already processed tag and trip the
   WARN_ON_ONCE() in the rollback path

 - xen-blkfront fix for a double completion of split requests on resume

 - drbd fix to reject data replies with an out-of-range payload size

* tag 'block-7.2-20260710' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
  block: remove redundant GD_NEED_PART_SCAN in add_disk_final()
  drbd: reject data replies with an out-of-range payload size
  xen-blkfront: fix double completion of split requests on resume
  ublk: snapshot batch commands before preparing I/O
  block: Make WBT latency writes honor enable state
  block: avoid potential deadlock on zone revalidation failure
  blk-mq: bound blk_hctx_poll() to one jiffy