linux/security
Srish Srinivasan c9aeb168e8 keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal
[ Upstream commit 6342969daf ]

TPM2_Unseal[1] expects the handle of a loaded data object, and not the
handle of the parent key. But the tpm2_unseal_cmd provides the parent
keyhandle instead of blob_handle for the session HMAC calculation. This
causes unseal to fail.

Fix this by passing blob_handle to tpm_buf_append_name().

References:

[1] trustedcomputinggroup.org/wp-content/uploads/
    Trusted-Platform-Module-2.0-Library-Part-3-Version-184_pub.pdf

Fixes: 6e9722e9a7 ("tpm2-sessions: Fix out of range indexing in name_size")
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-01-30 10:32:22 +01:00
..
apparmor file->f_path constification 2025-10-03 16:32:36 -07:00
bpf bpf: lsm: Remove hook to bpf_task_storage_free 2024-12-16 12:32:31 -08:00
integrity kernel/kexec: change the prototype of kimage_map_segment() 2026-01-08 10:17:10 +01:00
ipe ipe/stable-6.17 PR 20250728 2025-07-31 09:42:20 -07:00
keys keys/trusted_keys: fix handle passed to tpm_buf_append_name during unseal 2026-01-30 10:32:22 +01:00
landlock landlock: Fix wrong type usage 2026-01-23 11:21:22 +01:00
loadpin loadpin: remove MODULE_COMPRESS_NONE as it is no longer supported 2025-03-03 09:35:50 -08:00
lockdown lockdown: initialize local array before use to quiet static analysis 2025-01-05 12:48:43 -05:00
safesetid safesetid: check size of policy writes 2025-01-04 22:46:09 -05:00
selinux selinux: rename the cred_security_struct variables to "crsec" 2025-11-20 16:47:50 -05:00
smack smack: fix bug: setting task label silently ignores input garbage 2025-12-18 14:02:25 +01:00
tomoyo copy_process: pass clone_flags as u64 across calltree 2025-09-01 15:31:34 +02:00
yama yama: don't abuse rcu_read_lock/get_task_struct in yama_task_prctl() 2025-03-07 19:58:05 -08:00
commoncap.c exec: Correct the permission check for unsafe exec 2025-06-23 10:38:39 -05:00
device_cgroup.c device_cgroup: Fix kernel-doc warnings in device_cgroup 2023-06-21 09:30:49 -04:00
inode.c make securityfs_remove() remove the entire subtree 2025-06-11 18:19:46 -04:00
Kconfig lsm: CONFIG_LSM can depend on CONFIG_SECURITY 2025-09-11 16:32:04 -04:00
Kconfig.hardening rust: add bitmap API. 2025-09-22 15:52:44 -04:00
lsm_audit.c net: Retire DCCP socket. 2025-04-11 18:58:10 -07:00
lsm_syscalls.c lsm: use 32-bit compatible data types in LSM syscalls 2024-03-14 11:31:26 -04:00
Makefile lsm: Only build lsm_audit.c if CONFIG_SECURITY and CONFIG_AUDIT are set 2025-01-04 11:50:44 -05:00
min_addr.c security: use umax() to improve code 2025-08-18 15:41:47 -04:00
security.c Simplifying ->d_name audits, easy part. 2025-10-03 11:14:02 -07:00