struct tpm_buf now uses an embedded flexible array for data, which is
6 bytes shorter than TPM_BUFSIZE due to the struct header. But
tpm_transmit_cmd() still passes PAGE_SIZE to tpm_transmit(), and after
clamping to TPM_BUFSIZE in tpm_try_transmit(), chip->ops->recv() can
write past the end of data[] by 6 bytes.

Pass buf->capacity to tpm_transmit() instead.

Fixes: 3d9e043dab0a ("tpm-buf: Memory-safe allocations")
Cc: stable@vger.kernel.org
Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
---
 drivers/char/tpm/tpm-interface.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
index f745a098908b..1ccdbde98b69 100644
--- a/drivers/char/tpm/tpm-interface.c
+++ b/drivers/char/tpm/tpm-interface.c
@@ -268,7 +268,7 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf,
 	int err;
 	ssize_t len;
 
-	len = tpm_transmit(chip, buf->data, PAGE_SIZE);
+	len = tpm_transmit(chip, buf->data, buf->capacity);
 	if (len <  0)
 		return len;
 
-- 
2.25.1

On Tue, Sep 01, 2026 at 02:28:50PM +0800, Jiangshan Yi wrote:
> struct tpm_buf now uses an embedded flexible array for data, which is
> 6 bytes shorter than TPM_BUFSIZE due to the struct header. But
> tpm_transmit_cmd() still passes PAGE_SIZE to tpm_transmit(), and after
> clamping to TPM_BUFSIZE in tpm_try_transmit(), chip->ops->recv() can
> write past the end of data[] by 6 bytes.
> 
> Pass buf->capacity to tpm_transmit() instead.
> 
> Fixes: 3d9e043dab0a ("tpm-buf: Memory-safe allocations")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jiangshan Yi <yijiangshan@kylinos.cn>
> ---
>  drivers/char/tpm/tpm-interface.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
> index f745a098908b..1ccdbde98b69 100644
> --- a/drivers/char/tpm/tpm-interface.c
> +++ b/drivers/char/tpm/tpm-interface.c
> @@ -268,7 +268,7 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, struct tpm_buf *buf,
>  	int err;
>  	ssize_t len;
>  
> -	len = tpm_transmit(chip, buf->data, PAGE_SIZE);
> +	len = tpm_transmit(chip, buf->data, buf->capacity);
>  	if (len <  0)
>  		return len;
>  
> -- 
> 2.25.1
> 

Thank you good catch!

I'll apply this and put to rc2 PR. 

BR, Jarkko