From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1794057348; b=clEveyEBIb/AD97ei7DB9g7E5VGpD7/1X4SD14XP7uNoH7S9zABLdDcKqmKZvb/203Hv 5kiFUkkJsHz8AlNzwzPNvhDnZYn9NRMUORjLg+VX+pMd7mT8dFeCpObzXbQm1r4xwfbTA WggeMTmxPfRJDQU5I9Bjo+d0NncyTntFbC2N/Uy2zkzyLlK45va26LstplAou0OUWCVMo cOWzwPeAzv/Lo/Jzh1ByDGeUn8y6vL2ab4TEamtJhR5Bmg4NAPdS7Lh5hzPQaGoLZ83Ly 8gS9Pe0sthjssp4BcePIl/mqsYBeGXAhZTOzg4NYWAsCrk+wMNeWMst9AbNYYB9xDVA== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1794057348; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=EmWFUwaXsKid4Tdbmnzb8caoNZS4EAXc8KxdwqOt0p4=; b=THRxDRAExS3UEWihvrAxdb6snlGYxK96ERJ9ZG+T87xVpSJuv0kADWJd3nyeEqS/Kx9e 3ILh63G8ufQ9vLbm2PdPYajJrEMS6pNid25z8TeuLmY5Lvsvpryv5f0ZqtH0Y39LYRpH+ dmjuhH9Bw+FPSrvbCEuav04EBnlqqwl5uZyDdnjLiUm6/z/f9UptcDdTHeNpkgSlZMB3l DyDMsZkhmrfMGsr4bzrJ541AiJmPSN2CDA1Y69m3SJmIKkFi1sDrELdd0SX3qX79I33CI HAjTyPYE2nz9lZIsUu9kqC3IrVhogz2VkH5QiDnsp4zzt8tSfFds2GCFg3NSkqOpT6Q== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=jlsyfo1a; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with UTF8SMTPS id 3FD69606A32F; Sat, 7 Nov 2026 13:15:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=jlsyfo1a Received: by smtp.kernel.org (Postfix) with UTF8SMTPSA id 1A6181F008A5; Sat, 7 Nov 2026 13:15:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1794057347; bh=EmWFUwaXsKid4Tdbmnzb8caoNZS4EAXc8KxdwqOt0p4=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=jlsyfo1aYJdwm2diHEzN0mjS/x9F2N2GeN/gjuJoAkzcwA/xK///INRXJKqMg7oA6 Q1bZkJudHlDSiLdacFM+a2uytfmmZh3EkUiH4GtgYRNAL74Jh6a++oN9/XsB5NDG7j OtyQ2DCgWbdny9WU3/TZm1iTL+ME3HzKFv4n+yUJ9KhcAZpOfkd/86UlqySxMzcYQr w7Hg7+XZjceVHSSLmh+5+Asg7mitbw5Zen5C4UCdUo6yaumHAQc/ELOJi9Ycwn16P1 PzB8Fu+xbDbb8FtocLs0HJHAhQZIr02YON/vj4M3qVc0hGXNaeoT7ecbhi7IyDE6e1 xrCNideHs0LIg== From: Jarkko Sakkinen To: David Howells Cc: Jarkko Sakkinen , keyrings@vger.kernel.org, linux-afs@lists.infradead.org, linux-cifs@vger.kernel.org, linux-integrity@vger.kernel.org, linux-kernel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-s390@vger.kernel.org, linux-security-module@vger.kernel.org, netdev@vger.kernel.org, Alexander Gordeev , Anna Schumaker , Bharath SM , Christian Borntraeger , "David S. Miller" , Eric Biggers , Eric Dumazet , Heiko Carstens , Jakub Kicinski , James Bottomley , James Morris , Marc Dionne , Mimi Zohar , Namjae Jeon , Paolo Abeni , Paul Moore , Paulo Alcantara , Ronnie Sahlberg , "Serge E. Hallyn" , Shyam Prasad N , Simon Horman , Sumit Garg , Sven Schnelle , Tom Talpey , Trond Myklebust , Vasily Gorbik Subject: [PATCH v4 07/11] KEYS: trusted: TEE: Synchronize session lifetime Date: Sat, 7 Nov 2026 15:15:08 +0200 Message-ID: <20261107131512.3603168-8-jarkko@kernel.org> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20261107131512.3603168-1-jarkko@kernel.org> References: <20261107131512.3603168-1-jarkko@kernel.org> X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit While the sysfs bind attributes are now suppressed, the parent TEE device can still remove the device while the instances keep trusted.ko loaded. Update the static calls before invoking backend init() and reset them in the case of a failure. In the TEE backend, guard session context state with a mutex, publish pvt_data.dev before registering key_type_trusted and sanitize pvt_data on probe failure and removal. When an active TEE has not been bound, reject seal, unseal and get_random with -ENODEV. Signed-off-by: Jarkko Sakkinen --- security/keys/trusted-keys/trusted_core.c | 15 ++-- security/keys/trusted-keys/trusted_tee.c | 86 +++++++++++++++++------ 2 files changed, 75 insertions(+), 26 deletions(-) diff --git a/security/keys/trusted-keys/trusted_core.c b/security/keys/trusted-keys/trusted_core.c index 0509d9955f2a..11d7d296d063 100644 --- a/security/keys/trusted-keys/trusted_core.c +++ b/security/keys/trusted-keys/trusted_core.c @@ -373,14 +373,19 @@ static int __init init_trusted(void) if (!get_random) get_random = kernel_get_random; + static_call_update(trusted_key_seal, trusted_key_sources[i].ops->seal); + static_call_update(trusted_key_unseal, trusted_key_sources[i].ops->unseal); + static_call_update(trusted_key_get_random, get_random); + migratable = trusted_key_sources[i].ops->migratable; + ret = trusted_key_sources[i].ops->init(); if (!ret) { - static_call_update(trusted_key_seal, trusted_key_sources[i].ops->seal); - static_call_update(trusted_key_unseal, trusted_key_sources[i].ops->unseal); - static_call_update(trusted_key_get_random, get_random); - trusted_key_exit = trusted_key_sources[i].ops->exit; - migratable = trusted_key_sources[i].ops->migratable; + } else { + static_call_update(trusted_key_seal, NULL); + static_call_update(trusted_key_unseal, NULL); + static_call_update(trusted_key_get_random, NULL); + migratable = 0; } if (!ret || ret != -ENODEV) diff --git a/security/keys/trusted-keys/trusted_tee.c b/security/keys/trusted-keys/trusted_tee.c index 227efb668aa9..87ea549f7f0b 100644 --- a/security/keys/trusted-keys/trusted_tee.c +++ b/security/keys/trusted-keys/trusted_tee.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -56,6 +57,8 @@ struct trusted_key_tee_private { }; static struct trusted_key_tee_private pvt_data; +/* Do not hold this mutex across key type registration or unregistration. */ +static DEFINE_MUTEX(trusted_key_tee_mutex); /* * Have the TEE seal(encrypt) the symmetric key @@ -67,6 +70,12 @@ static int trusted_tee_seal(struct trusted_key_payload *p, char *datablob) struct tee_param param[4]; struct tee_shm *reg_shm = NULL; + mutex_lock(&trusted_key_tee_mutex); + if (!pvt_data.ctx) { + ret = -ENODEV; + goto out_unlock; + } + memset(&inv_arg, 0, sizeof(inv_arg)); memset(¶m, 0, sizeof(param)); @@ -74,7 +83,8 @@ static int trusted_tee_seal(struct trusted_key_payload *p, char *datablob) sizeof(p->key) + sizeof(p->blob)); if (IS_ERR(reg_shm)) { dev_err(pvt_data.dev, "shm register failed\n"); - return PTR_ERR(reg_shm); + ret = PTR_ERR(reg_shm); + goto out_unlock; } inv_arg.func = TA_CMD_SEAL; @@ -100,7 +110,8 @@ static int trusted_tee_seal(struct trusted_key_payload *p, char *datablob) } tee_shm_free(reg_shm); - +out_unlock: + mutex_unlock(&trusted_key_tee_mutex); return ret; } @@ -114,6 +125,12 @@ static int trusted_tee_unseal(struct trusted_key_payload *p, char *datablob) struct tee_param param[4]; struct tee_shm *reg_shm = NULL; + mutex_lock(&trusted_key_tee_mutex); + if (!pvt_data.ctx) { + ret = -ENODEV; + goto out_unlock; + } + memset(&inv_arg, 0, sizeof(inv_arg)); memset(¶m, 0, sizeof(param)); @@ -121,7 +138,8 @@ static int trusted_tee_unseal(struct trusted_key_payload *p, char *datablob) sizeof(p->key) + sizeof(p->blob)); if (IS_ERR(reg_shm)) { dev_err(pvt_data.dev, "shm register failed\n"); - return PTR_ERR(reg_shm); + ret = PTR_ERR(reg_shm); + goto out_unlock; } inv_arg.func = TA_CMD_UNSEAL; @@ -147,7 +165,8 @@ static int trusted_tee_unseal(struct trusted_key_payload *p, char *datablob) } tee_shm_free(reg_shm); - +out_unlock: + mutex_unlock(&trusted_key_tee_mutex); return ret; } @@ -161,13 +180,20 @@ static int trusted_tee_get_random(unsigned char *key, size_t key_len) struct tee_param param[4]; struct tee_shm *reg_shm = NULL; + mutex_lock(&trusted_key_tee_mutex); + if (!pvt_data.ctx) { + ret = -ENODEV; + goto out_unlock; + } + memset(&inv_arg, 0, sizeof(inv_arg)); memset(¶m, 0, sizeof(param)); reg_shm = tee_shm_register_kernel_buf(pvt_data.ctx, key, key_len); if (IS_ERR(reg_shm)) { dev_err(pvt_data.dev, "key shm register failed\n"); - return PTR_ERR(reg_shm); + ret = PTR_ERR(reg_shm); + goto out_unlock; } inv_arg.func = TA_CMD_GET_RANDOM; @@ -189,7 +215,8 @@ static int trusted_tee_get_random(unsigned char *key, size_t key_len) } tee_shm_free(reg_shm); - +out_unlock: + mutex_unlock(&trusted_key_tee_mutex); return ret; } @@ -205,50 +232,67 @@ static int optee_ctx_match(struct tee_ioctl_version_data *ver, const void *data) static int trusted_key_probe(struct tee_client_device *rng_device) { struct device *dev = &rng_device->dev; + struct tee_context *ctx; int ret; struct tee_ioctl_open_session_arg sess_arg; + mutex_lock(&trusted_key_tee_mutex); + if (pvt_data.ctx) { + ret = -EBUSY; + goto out_unlock; + } + memset(&sess_arg, 0, sizeof(sess_arg)); - pvt_data.ctx = tee_client_open_context(NULL, optee_ctx_match, NULL, - NULL); - if (IS_ERR(pvt_data.ctx)) - return -ENODEV; + ctx = tee_client_open_context(NULL, optee_ctx_match, NULL, NULL); + if (IS_ERR(ctx)) { + ret = -ENODEV; + goto out_unlock; + } memcpy(sess_arg.uuid, rng_device->id.uuid.b, TEE_IOCTL_UUID_LEN); sess_arg.clnt_login = TEE_IOCTL_LOGIN_REE_KERNEL; sess_arg.num_params = 0; - ret = tee_client_open_session(pvt_data.ctx, &sess_arg, NULL); + ret = tee_client_open_session(ctx, &sess_arg, NULL); if ((ret < 0) || (sess_arg.ret != 0)) { dev_err(dev, "tee_client_open_session failed, err: %x\n", sess_arg.ret); ret = -EINVAL; goto out_ctx; } + pvt_data.ctx = ctx; pvt_data.session_id = sess_arg.session; - - ret = register_key_type(&key_type_trusted); - if (ret < 0) - goto out_sess; - pvt_data.dev = dev; + mutex_unlock(&trusted_key_tee_mutex); - return 0; + ret = register_key_type(&key_type_trusted); + if (!ret) + return 0; -out_sess: - tee_client_close_session(pvt_data.ctx, pvt_data.session_id); + mutex_lock(&trusted_key_tee_mutex); + tee_client_close_session(ctx, pvt_data.session_id); out_ctx: - tee_client_close_context(pvt_data.ctx); - + tee_client_close_context(ctx); + pvt_data.ctx = NULL; + pvt_data.dev = NULL; + pvt_data.session_id = 0; +out_unlock: + mutex_unlock(&trusted_key_tee_mutex); return ret; } static void trusted_key_remove(struct tee_client_device *dev) { unregister_key_type(&key_type_trusted); + + mutex_lock(&trusted_key_tee_mutex); tee_client_close_session(pvt_data.ctx, pvt_data.session_id); tee_client_close_context(pvt_data.ctx); + pvt_data.ctx = NULL; + pvt_data.dev = NULL; + pvt_data.session_id = 0; + mutex_unlock(&trusted_key_tee_mutex); } static const struct tee_client_device_id trusted_key_id_table[] = { -- 2.47.3