Commit cc7d8594 authored by Jarkko Sakkinen's avatar Jarkko Sakkinen
Browse files

tpm: Rollback tpm2_load_null() 



Do not continue on tpm2_create_primary() failure in tpm2_load_null().

Cc: stable@vger.kernel.org # v6.10+
Fixes: eb24c978 ("tpm: disable the TPM if NULL name changes")
Reviewed-by: default avatarStefan Berger <stefanb@linux.ibm.com>
Signed-off-by: default avatarJarkko Sakkinen <jarkko@kernel.org>
parent d658d594

drivers/char/tpm/tpm2-sessions.c

+24 −20
Original line number Diff line number Diff line
@@ -915,33 +915,37 @@ static int tpm2_parse_start_auth_session(struct tpm2_auth *auth, 


static int tpm2_load_null(struct tpm_chip *chip, u32 *null_key)

{

	int rc;

	unsigned int offset = 0; /* dummy offset for null seed context */

	u8 name[SHA256_DIGEST_SIZE + 2];

	u32 tmp_null_key;

	int rc;



	rc = tpm2_load_context(chip, chip->null_key_context, &offset,

			       null_key);

	if (rc != -EINVAL)

		return rc;

			       &tmp_null_key);

	if (rc != -EINVAL) {

		if (!rc)

			*null_key = tmp_null_key;

		goto err;

	}



	/* an integrity failure may mean the TPM has been reset */

	dev_err(&chip->dev, "NULL key integrity failure!\n");

	/* check the null name against what we know */

	tpm2_create_primary(chip, TPM2_RH_NULL, NULL, name);

	if (memcmp(name, chip->null_key_name, sizeof(name)) == 0)

		/* name unchanged, assume transient integrity failure */

		return rc;

	/*

	 * Fatal TPM failure: the NULL seed has actually changed, so

	 * the TPM must have been illegally reset.  All in-kernel TPM

	 * operations will fail because the NULL primary can't be

	 * loaded to salt the sessions, but disable the TPM anyway so

	 * userspace programmes can't be compromised by it.

	 */

	dev_err(&chip->dev, "NULL name has changed, disabling TPM due to interference\n");

	/* Try to re-create null key, given the integrity failure: */

	rc = tpm2_create_primary(chip, TPM2_RH_NULL, &tmp_null_key, name);

	if (rc)

		goto err;



	/* Return null key if the name has not been changed: */

	if (!memcmp(name, chip->null_key_name, sizeof(name))) {

		*null_key = tmp_null_key;

		return 0;

	}



	/* Deduce from the name change TPM interference: */

	dev_err(&chip->dev, "null key integrity check failed\n");

	tpm2_flush_context(chip, tmp_null_key);

	chip->flags |= TPM_CHIP_FLAG_DISABLE;



	return rc;

err:

	return rc ? -ENODEV : 0;

}



/**