Re: [PATCH] tpm: Disable TPM on null key name mismatch

[Jarkko Sakkinen]

On Fri, Sep 18, 2026 at 12:07:31AM +0000, Surendran Kanagaraj wrote:
> The null key name check exists to protect against TPM reset attacks, so
> a mismatch should stop the device from serving further requests.
> Currently it does not disable the chip when it finds a mismatch.
> 
> The mismatch is logged:
> 
>     tpm tpm0: null key integrity check failed
> 
> but the chip keeps serving commands:
> 
>     / # tpm2_getcap -c properties-fixed
>     TPM_PT_FAMILY_INDICATOR:
>       as UINT32:                0x08322e3000
>       as string:                "2.0"
>     ...
> 
> tpm2_load_null() where the null key name check is run sets the chip as
> disabled only if the rc is non zero. When the mismatch is seen, rc is
> zero at that point and it returns success. The other issue is that the
> caller expects the null key handle to be populated when the function
> returns 0 which it does here without writing the handle and proceeds
> assuming the null key handle is valid.
> 
> During the test, I noticed that tpm2_start_auth_session() uses the
> uninitialized stack value as the key handle since tpm2_load_null()
> returns 0 despite the integrity failure and proceeds with
> TPM2_CC_START_AUTH_SESS with this value as salt key handle.
> 
> Set rc to -ENODEV on the mismatch. The error path then disables the chip
> and returns the correct code to the caller.
> 
> Tested in QEMU with swtpm and CONFIG_TCG_TPM2_HMAC=y by making
> TPM2_CC_CONTEXT_LOAD fail with TPM2_RC_INTEGRITY and changing the name
> of the re-created null key. The chip is now disabled on the mismatch.
> 
> Fixes: cc7d8594342a ("tpm: Rollback tpm2_load_null()")
> Fixes: 423893fcbe7e ("tpm: Disable TPM on tpm2_create_primary() failure")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: LLM
> Signed-off-by: Surendran Kanagaraj <surenkj@xxxxxxxxxx>
> ---
>  drivers/char/tpm/tpm2-sessions.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c
> index cf8f1fd6790b..ca1e2bf424e1 100644
> --- a/drivers/char/tpm/tpm2-sessions.c
> +++ b/drivers/char/tpm/tpm2-sessions.c
> @@ -975,6 +975,7 @@ static int tpm2_load_null(struct tpm_chip *chip, u32 *null_key)
>  	/* Deduce from the name change TPM interference: */
>  	dev_err(&chip->dev, "null key integrity check failed\n");
>  	tpm2_flush_context(chip, tmp_null_key);
> +	rc = -ENODEV;
>  
>  err:
>  	if (rc) {
> 
> base-commit: b5f1b25b21f56c9fff87ad0235791883d1bf01a9
> -- 
> 2.47.3
> 

Reviewed-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>

Thank you.

BR, Jarkko