The TPM character devices expose a sequential command/response
interface, but their open handlers leave FMODE_PREAD and FMODE_PWRITE
enabled.

After a command leaves a response pending, pread(fd, buf, 16, 0x1400)
passes 0x1400 as *off to tpm_common_read(). The transfer length is
bounded by response_length, but the offset is used unchecked when
forming data_buffer + *off. A sufficiently large offset therefore causes
an out-of-bounds heap read through copy_to_user() and, if the copy
succeeds, an out-of-bounds zero-write through the following memset().

Positional I/O does not provide coherent semantics for this interface.
An arbitrary pread offset cannot represent how much of a response has
been consumed sequentially. The write callback always stores a command
at the start of data_buffer, while pwrite() does not update file->f_pos
and can leave the sequential read cursor stale.

Call nonseekable_open() from both open handlers. This removes
FMODE_PREAD and FMODE_PWRITE, causing positional reads and writes to
fail with -ESPIPE before reaching the TPM callbacks, and explicitly
marks the files non-seekable. Normal read() and write() continue to use
the existing sequential f_pos cursor, leaving the response state machine
unchanged.

Tested on Linux 6.12 with KASAN and a swtpm TPM2 device:

 - sequential partial reads returned the complete response
 - pread() and preadv() with offset 0x1400 returned -ESPIPE
 - pwrite() and pwritev() with offset zero returned -ESPIPE
 - the pending response remained intact after the rejected operations
 - a subsequent normal command/response cycle completed normally
 - no KASAN report was produced.

Fixes: 9488585b21be ("tpm: add support for partial reads")
Link: https://lore.kernel.org/all/20260710090217.191289-1-yong010301@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Jaewon Yang <yong010301@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>

Pull ipmi updates from Corey Minyard:
 "Lots of little tweaks.

  Nothing huge, the biggest issue was a possible refcount underflow that
  could cause a memory leak in some situations. Otherwise, fixing
  formatting and style things and some docs typos"

* tag 'for-linus-7.2-1' of https://github.com/cminyard/linux-ipmi:
  docs: ipmi: Fix path of the "hotmod" module parameter
  ipmi: Drop unused assignment of platform_device_id driver data
  ipmi: si: Use platform_get_irq_optional() to retrieve interrupt
  ipmi: fix refcount leak in i_ipmi_request()
  ipmi:ssif: Drop unused assignment of platform_device_id driver data
  ipmi: Fix user refcount underflow in event delivery
  ipmi: Use named initializers for struct i2c_device_id
  ipmi: Use LIST_HEAD() to initialize on stack list head
  ipmi:kcs: Reduce the number of retries

Pull x86 platform driver updates from Ilpo Järvinen:

 - amd/hfi: Add support for dynamic ranking tables (version 3)

 - amd/pmc:
     - Add PMC driver support for AMD 1Ah M80H SoC
     - Delay suspend for some Lenovo Laptops to avoid keyboard and lid
       switch problems after s2idle

 - arm64: qcom-hamoa-ec: Add Hamoa/Purwa/Glymur EC driver

 - asus-armoury: add support for G614PR, GA402NJ, GA403UM, and FX608JPR

 - asus-wmi: add keystone dongle support

 - dell-dw5826e: Add reset driver for DW5826e

 - dell-laptop: Fix rollback path

 - hp-wmi:
     - Add support for Omen 16-ap0xxx (board ID 8D26) and board ID 8B2F

 - intel-hid:
     - Add HP ProBook x360 440 G1 5 button array support
     - Prevent racing ACPI notify handlers

 - intel/pmc:
     - Add Nova Lake support
     - Rate-limit LTR scale-factor warning

 - intel-uncore-freq:
     - Expose instance ID in the sysfs
     - Fix current_freq_khz after CPU hotplug

 - intel/vsec: Restore BAR fallback for header walk

 - ISST: Restore SST-PP control to all domains

 - lenovo-wmi-*:
     - Add more CPU tunable attributes
     - Add GPU tunable attributes
     - Add WMI battery charge limiting

 - oxpec: add support for OneXPlayer Super X

 - sel3350-platform: Retain LED state on load and unload

 - surface: SAM: Add support for Surface Pro 12in

 - uniwill-laptop: Add support for battery charge modes

 - tools/power/x86/intel-speed-select: Harden daemon pidfile open

 - Major refactoring efforts:
     - ACPI driver to platform driver conversion
     - Converting drivers to use the improved WMI API

 - Miscellaneous cleanups / refactoring / improvements

* tag 'platform-drivers-x86-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (115 commits)
  platform/x86/intel/pmc: Add NVL PCI IDs for SSRAM telemetry discovery
  platform/x86/intel/pmc/ssram: Make PMT registration optional
  platform/x86/intel/pmc/ssram: Add ACPI discovery scaffolding
  platform/x86/intel/pmc/ssram: Switch to static array with per-index probe state
  platform/x86/intel/pmc/ssram: Refactor DEVID/PWRMBASE extraction into helper
  platform/x86/intel/pmc/ssram: Add PCI platform data
  platform/x86/intel/pmc/ssram: Rename probe and PCI ID table for consistency
  platform/x86/intel/pmc: Add ACPI PWRM telemetry driver for Nova Lake S
  platform/x86/intel/pmc: Add PMC SSRAM Kconfig description
  platform/x86/intel/pmt: Unify header fetch and add ACPI source
  platform/x86/intel/pmt: Cache the telemetry discovery header
  platform/x86/intel/pmt: Pass discovery index instead of resource
  platform/x86/intel/pmt/telemetry: Move overlap check to post-decode hook
  platform/x86/intel/pmt/crashlog: Split init into pre-decode
  platform/x86/intel/pmt: Add pre/post decode hooks around header parsing
  modpost: Handle malformed WMI GUID strings
  platform/wmi: Make sysfs attributes const
  platform/wmi: Make wmi_bus_class const
  hwmon: (dell-smm) Use new buffer-based WMI API
  platform/x86: dell-ddv: Use new buffer-based WMI API
  ...

Pull tpm updates from Jarkko Sakkinen:
 "Only bug fixes"

* tag 'for-next-tpm-7.2-rc1-fixed' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  tpm: fix event_size output in tpm1_binary_bios_measurements_show
  tpm: tpm_crb_ffa: revert defered_probed when tpm_crb_ffa is built-in
  tpm: tpm2-sessions: wait for async KPP completion in tpm_buf_append_salt
  tpm: tpm_tis: Add settle time for some TPMs
  tpm: tpm_tis: store entire did_vid
  tpm_crb: Check ACPI_COMPANION() against NULL during probe
  tpm: tpm_tis_spi: Use wait_woken() in wait_for_tmp_stat()
  tpm: Initialize name_size_alg for non-NULL name in tpm_buf_append_name()
  tpm: restore timeout for key creation commands
  tpm: svsm: constify tpm_chip_ops

Pull misc driver updates from Greg KH:
 "Here is the big set of char, misc, iio, fpga, and other small driver
  subsystems changes for 7.2-rc1.

  Lots of little stuff in here, the majority being of course the IIO
  driver updates, as a list they are:

   - IIO driver updates and additions

   - GPIB driver bugfixes and cleanups

   - Android binder driver updates (rust and C version)

   - counter driver updates

   - MHI driver updates

   - mei driver updates

   - w1 driver updates

   - interconnect driver updates

   - Comedi driver fixes and updates

   - some obsolete char drivers removed (applicom and dtlk)

   - hwtracing driver updates

   - other tiny driver updates

  All of these have been in linux-next for a while with no reported
  issues"

* tag 'char-misc-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc: (406 commits)
  w1: ds2482: Use named initializers for arrays of i2c_device_data
  firmware: stratix10-svc: Add support to query Arm Trusted Firmware (ATF) version
  firmware: stratix10-rsu: avoid blocking reboot_image sysfs when busy
  coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
  iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure
  iio: chemical: scd30: Replace manual locking with RAII locking
  iio: light: tsl2591: remove unneeded tsl2591_compatible_als_persist_cycle()
  iio: dac: ad5686: create bus ops struct
  iio: dac: ad5686: cleanup doc header of local structs
  iio: dac: ad5686: add control_sync() for single-channel devices
  iio: dac: ad5686: add helpers to handle powerdown masks
  iio: dac: ad5686: add of_match table to the spi driver
  iio: dac: ad5686: drop enum id
  iio: dac: ad5686: remove redundant register definition
  iio: dac: ad5686: refactor include headers
  iio: adc: ad4080: fix AD4880 chip ID
  iio: light: veml3328: add support for new device
  dt-bindings: iio: light: veml6030: add veml3328
  fpga: microchip-spi: fix zero header_size OOB read in mpf_ops_parse_header()
  fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
  ...

Commit 186d124f07da ("tpm_eventlog.c: fix binary_bios_measurements")
split the output to write the endian-converted event header first and
then the variable-length event data.

However, the split was at sizeof(struct tcpa_event) - 1, even though
event_data was a zero-length array, and later a flexible array member,
both of which already excluded the event data.

Therefore, the current code writes the first three bytes of event_size
from the endian-converted header and then the last byte from the raw
header, which can emit a corrupted event_size on PPC64, where
do_endian_conversion() maps to be32_to_cpu().

Split one byte later to write the full endian-converted header first,
followed by the variable-length event->event_data.

Fixes: 186d124f07da ("tpm_eventlog.c: fix binary_bios_measurements")
Cc: stable@vger.kernel.org # v5.10+
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

commit 746d9e9f62a6 ("tpm: tpm_crb_ffa: try to probe tpm_crb_ffa when it's built-in")
probe tpm_crb_ffa forcefully when it's built-in to integrate with IMA.

However, IMA now provides the IMA_INIT_LATE_SYNC build option, which
initialises IMA at the late_initcall_sync level, so this change is no
longer required.

Signed-off-by: Yeoreum Yun <yeoreum.yun@arm.com>
Link: https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux.git/commit/?h=for-next/ffa/updates&id=cc7e8f21b9f0c229d68cf19a837cba82b5ac2d87 [0]
Link: https://git.kernel.org/pub/scm/linux/kernel/git/sudeep.holla/linux.git/commit/?h=for-next/ffa/updates&id=e659fc8e537c7a21d5d693d6f30d8852f2fa8d91 [1]
Link: https://lore.kernel.org/r/20260605144325.434436-5-yeoreum.yun@arm.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

tpm_buf_append_salt() in drivers/char/tpm/tpm2-sessions.c calls
crypto_kpp_generate_public_key() and crypto_kpp_compute_shared_secret()
without installing a completion callback, discards both return values,
and immediately frees the kpp_request via kpp_request_free(). When the
resolved ecdh-nist-p256 KPP backend is asynchronous (atmel-ecc, HPRE,
keembay-ocs), either operation returns -EINPROGRESS and the deferred
completion worker dereferences the freed request.

The path fires automatically from the hwrng_fillfn kernel thread via
tpm_get_random -> tpm2_get_random -> tpm2_start_auth_session ->
tpm_buf_append_salt on every entropy poll, without any userland action.

Install crypto_req_done as the completion callback, wrap both KPP
operations in crypto_wait_req(), and propagate errors to the caller.
The wait is a no-op for synchronous backends.

Fixes: 1085b8276bb4 ("tpm: Add the rest of the session HMAC API")
Cc: stable@vger.kernel.org # v6.10+
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
Assisted-by: Claude:claude-opus-4-7
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

Some TPMs fail to grant locality when requested immediately after being
relinquished. In this case, the TPM_ACCESS_REQUEST_USE bit of the
TPM_ACCESS register is cleared immediately without setting
TPM_ACCESS_ACTIVE_LOCALITY.

This issue can be seen at boot since tpm_chip_start, called right
after locality is relinquished, will fail. This causes the probe to
fail:

tpm_tis MSFT0101:00: probe with driver tpm_tis failed with error -1

This occurs on some older Dell Latitudes. For the Nuvoton TPM used in
these machines, add a delay after locality is relinquished.

Signed-off-by: Jim Broadus <jbroadus@gmail.com>
Link: https://lore.kernel.org/r/20260526232245.5409-3-jbroadus@gmail.com
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>