The patch below does not apply to the 6.9-stable tree. If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to stable@vger.kernel.org.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.9.y git checkout FETCH_HEAD git cherry-pick -x 25ee48a55fd59c72e0bd46dd9160c2d406b5a497 # <resolve conflicts, build, test, etc.> git commit -s git send-email --to 'stable@vger.kernel.org' --in-reply-to '2024070848-graveness-probiotic-9eb0@gregkh' --subject-prefix 'PATCH 6.9.y' HEAD^..

Possible dependencies:

25ee48a55fd5 ("tpm: Address !chip->auth in tpm2_*_auth_session()") eb24c9788cd9 ("tpm: disable the TPM if NULL name changes") d0a25bb961e6 ("tpm: Add HMAC session name/handle append") 699e3efd6c64 ("tpm: Add HMAC session start and end functions") 033ee84e5f01 ("tpm: Add TCG mandated Key Derivation Functions (KDFs)") d2add27cf2b8 ("tpm: Add NULL primary creation") 17d89b2e2f76 ("tpm: Move buffer handling from static inlines to real functions") cf792e903aff ("tpm: Remove unused tpm_buf_tag()")

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 25ee48a55fd59c72e0bd46dd9160c2d406b5a497 Mon Sep 17 00:00:00 2001 From: Jarkko Sakkinen jarkko@kernel.org Date: Wed, 3 Jul 2024 19:39:27 +0300 Subject: [PATCH] tpm: Address !chip->auth in tpm2_*_auth_session()

Unless tpm_chip_bootstrap() was called by the driver, !chip->auth can cause a null derefence in tpm2_*_auth_session(). Thus, address !chip->auth in tpm2_*_auth_session().

Cc: stable@vger.kernel.org # v6.9+ Reported-by: Stefan Berger stefanb@linux.ibm.com Closes: https://lore.kernel.org/linux-integrity/20240617193408.1234365-1-stefanb@lin... Fixes: 699e3efd6c64 ("tpm: Add HMAC session start and end functions") Tested-by: Michael Ellerman mpe@ellerman.id.au # ppc Signed-off-by: Jarkko Sakkinen jarkko@kernel.org

diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c index 907ac9956a78..2f1d96a5a5a7 100644 --- a/drivers/char/tpm/tpm2-sessions.c +++ b/drivers/char/tpm/tpm2-sessions.c @@ -824,8 +824,13 @@ EXPORT_SYMBOL(tpm_buf_check_hmac_response); */ void tpm2_end_auth_session(struct tpm_chip *chip) { - tpm2_flush_context(chip, chip->auth->handle); - memzero_explicit(chip->auth, sizeof(*chip->auth)); + struct tpm2_auth *auth = chip->auth; + + if (!auth) + return; + + tpm2_flush_context(chip, auth->handle); + memzero_explicit(auth, sizeof(*auth)); } EXPORT_SYMBOL(tpm2_end_auth_session);

@@ -907,6 +912,11 @@ int tpm2_start_auth_session(struct tpm_chip *chip) int rc; u32 null_key;

+ if (!auth) { + dev_warn_once(&chip->dev, "auth session is not active\n"); + return 0; + } + rc = tpm2_load_null(chip, &null_key); if (rc) goto out;