tpm: disable the TPM if NULL name changes

Browse source

Update tpm2_load_context() to return -EINVAL on integrity failures and
use this as a signal when loading the NULL context that something
might be wrong.  If the signal fails, check the name of the NULL
primary against the one stored in the chip data and if there is a
mismatch disable the TPM because it is likely to have suffered a reset
attack.

Signed-off-by: James Bottomley <James.Bottomley@HansenPartnership.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

...

This commit is contained in:

James Bottomley 2024-04-29 16:28:11 -04:00 • committed by Jarkko Sakkinen

parent 3d2daf9d59

commit eb24c9788c

4 changed files with 70 additions and 17 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

drivers/char/tpm/tpm-chip.c

View file

77

drivers/char/tpm/tpm2-sessions.c

View file

3

drivers/char/tpm/tpm2-space.c

View file

4

include/linux/tpm.h

View file