[PATCH] tpm: Disable TPM on null key name mismatch

[PATCH] tpm: Disable TPM on null key name mismatch

[Surendran Kanagaraj]

The null key name check exists to protect against TPM reset attacks, so
a mismatch should stop the device from serving further requests.
Currently it does not disable the chip when it finds a mismatch.

The mismatch is logged:

    tpm tpm0: null key integrity check failed

but the chip keeps serving commands:

    / # tpm2_getcap -c properties-fixed
    TPM_PT_FAMILY_INDICATOR:
      as UINT32:                0x08322e3000
      as string:                "2.0"
    ...

tpm2_load_null() where the null key name check is run sets the chip as
disabled only if the rc is non zero. When the mismatch is seen, rc is
zero at that point and it returns success. The other issue is that the
caller expects the null key handle to be populated when the function
returns 0 which it does here without writing the handle and proceeds
assuming the null key handle is valid.

During the test, I noticed that tpm2_start_auth_session() uses the
uninitialized stack value as the key handle since tpm2_load_null()
returns 0 despite the integrity failure and proceeds with
TPM2_CC_START_AUTH_SESS with this value as salt key handle.

Set rc to -ENODEV on the mismatch. The error path then disables the chip
and returns the correct code to the caller.

Tested in QEMU with swtpm and CONFIG_TCG_TPM2_HMAC=y by making
TPM2_CC_CONTEXT_LOAD fail with TPM2_RC_INTEGRITY and changing the name
of the re-created null key. The chip is now disabled on the mismatch.

Fixes: cc7d8594342a ("tpm: Rollback tpm2_load_null()")
Fixes: 423893fcbe7e ("tpm: Disable TPM on tpm2_create_primary() failure")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Surendran Kanagaraj <surenkj@amazon.com>
---
 drivers/char/tpm/tpm2-sessions.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c
index cf8f1fd6790b..ca1e2bf424e1 100644
--- a/drivers/char/tpm/tpm2-sessions.c
+++ b/drivers/char/tpm/tpm2-sessions.c
@@ -975,6 +975,7 @@ static int tpm2_load_null(struct tpm_chip *chip, u32 *null_key)
 	/* Deduce from the name change TPM interference: */
 	dev_err(&chip->dev, "null key integrity check failed\n");
 	tpm2_flush_context(chip, tmp_null_key);
+	rc = -ENODEV;
 
 err:
 	if (rc) {

base-commit: b5f1b25b21f56c9fff87ad0235791883d1bf01a9
-- 
2.47.3

Re: [PATCH] tpm: Disable TPM on null key name mismatch

[Jarkko Sakkinen]

On Fri, Sep 18, 2026 at 12:07:31AM +0000, Surendran Kanagaraj wrote:
> The null key name check exists to protect against TPM reset attacks, so
> a mismatch should stop the device from serving further requests.
> Currently it does not disable the chip when it finds a mismatch.
> 
> The mismatch is logged:
> 
>     tpm tpm0: null key integrity check failed
> 
> but the chip keeps serving commands:
> 
>     / # tpm2_getcap -c properties-fixed
>     TPM_PT_FAMILY_INDICATOR:
>       as UINT32:                0x08322e3000
>       as string:                "2.0"
>     ...
> 
> tpm2_load_null() where the null key name check is run sets the chip as
> disabled only if the rc is non zero. When the mismatch is seen, rc is
> zero at that point and it returns success. The other issue is that the
> caller expects the null key handle to be populated when the function
> returns 0 which it does here without writing the handle and proceeds
> assuming the null key handle is valid.
> 
> During the test, I noticed that tpm2_start_auth_session() uses the
> uninitialized stack value as the key handle since tpm2_load_null()
> returns 0 despite the integrity failure and proceeds with
> TPM2_CC_START_AUTH_SESS with this value as salt key handle.
> 
> Set rc to -ENODEV on the mismatch. The error path then disables the chip
> and returns the correct code to the caller.
> 
> Tested in QEMU with swtpm and CONFIG_TCG_TPM2_HMAC=y by making
> TPM2_CC_CONTEXT_LOAD fail with TPM2_RC_INTEGRITY and changing the name
> of the re-created null key. The chip is now disabled on the mismatch.
> 
> Fixes: cc7d8594342a ("tpm: Rollback tpm2_load_null()")
> Fixes: 423893fcbe7e ("tpm: Disable TPM on tpm2_create_primary() failure")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Surendran Kanagaraj <surenkj@amazon.com>
> ---
>  drivers/char/tpm/tpm2-sessions.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c
> index cf8f1fd6790b..ca1e2bf424e1 100644
> --- a/drivers/char/tpm/tpm2-sessions.c
> +++ b/drivers/char/tpm/tpm2-sessions.c
> @@ -975,6 +975,7 @@ static int tpm2_load_null(struct tpm_chip *chip, u32 *null_key)
>  	/* Deduce from the name change TPM interference: */
>  	dev_err(&chip->dev, "null key integrity check failed\n");
>  	tpm2_flush_context(chip, tmp_null_key);
> +	rc = -ENODEV;
>  
>  err:
>  	if (rc) {
> 
> base-commit: b5f1b25b21f56c9fff87ad0235791883d1bf01a9
> -- 
> 2.47.3
> 

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

Thank you.

BR, Jarkko

Re: [PATCH] tpm: Disable TPM on null key name mismatch

[Gunnar Kudrjavets]

On Fri, Sep 18, 2026 at 05:39:27AM +0300, Jarkko Sakkinen wrote:
> On Fri, Sep 18, 2026 at 12:07:31AM +0000, Surendran Kanagaraj wrote:
> > The null key name check exists to protect against TPM reset attacks, so
> > a mismatch should stop the device from serving further requests.
[...]
> > Set rc to -ENODEV on the mismatch. The error path then disables the chip
> > and returns the correct code to the caller.
>
> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

We reviewed this internally as well.

Reviewed-by: Gunnar Kudrjavets <gunnarku@amazon.com>