Skip to content

Commit 1dbf74e

Browse files
u1f35cjarkkojs
authored andcommitted
tpm: End any active auth session before shutdown
Lazy flushing of TPM auth sessions can interact badly with IMA + kexec, resulting in loaded session handles being leaked across the kexec and not cleaned up. Fix by ensuring any active auth session is ended before the TPM is told about the shutdown, matching what is done when suspending. Before: root@debian-qemu-efi:~# tpm2_getcap handles-loaded-session root@debian-qemu-efi:~# tpm2_getcap handles-saved-session root@debian-qemu-efi:~# kexec --load --kexec-file-syscall … root@debian-qemu-efi:~# systemctl kexec … root@debian-qemu-efi:~# tpm2_getcap handles-loaded-session - 0x2000000 root@debian-qemu-efi:~# tpm2_getcap handles-saved-session root@debian-qemu-efi:~# (repeat kexec steps) root@debian-qemu-efi:~# tpm2_getcap handles-loaded-session - 0x2000000 - 0x2000001 root@debian-qemu-efi:~# tpm2_getcap handles-saved-session root@debian-qemu-efi:~# After: root@debian-qemu-efi:~# tpm2_getcap handles-loaded-session root@debian-qemu-efi:~# tpm2_getcap handles-saved-session root@debian-qemu-efi:~# kexec --load --kexec-file-syscall … root@debian-qemu-efi:~# systemctl kexec … root@debian-qemu-efi:~# tpm2_getcap handles-loaded-session root@debian-qemu-efi:~# tpm2_getcap handles-saved-session root@debian-qemu-efi:~# Signed-off-by: Jonathan McDowell <noodles@meta.com> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
1 parent da086d4 commit 1dbf74e

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

drivers/char/tpm/tpm-chip.c

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -305,6 +305,7 @@ int tpm_class_shutdown(struct device *dev)
305305
down_write(&chip->ops_sem);
306306
if (chip->flags & TPM_CHIP_FLAG_TPM2) {
307307
if (!tpm_chip_start(chip)) {
308+
tpm2_end_auth_session(chip);
308309
tpm2_shutdown(chip, TPM2_SU_CLEAR);
309310
tpm_chip_stop(chip);
310311
}

0 commit comments

Comments
 (0)