[PATCH v5 4/5] tpm: tpm2_key: Extend parser to TPM_LoadableKey

From: Jarkko Sakkinen
Date: Thu May 23 2024 - 17:27:09 EST


Extend parser to TPM_LoadableKey. Add field for oid to struct tpm2_key
so that callers can differentiate different key types.

Signed-off-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
---
v3:
* Fixup klog messages:
https://lore.kernel.org/linux-integrity/SN7PR18MB53140F4341BC441C1C11586EE3EA2@xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx/
---
drivers/char/tpm/tpm2_key.c | 17 ++++++++++++-----
include/crypto/tpm2_key.h | 2 ++
security/keys/trusted-keys/trusted_tpm2.c | 4 ++++
3 files changed, 18 insertions(+), 5 deletions(-)

diff --git a/drivers/char/tpm/tpm2_key.c b/drivers/char/tpm/tpm2_key.c
index 7662b2cb85bf..b5c07288eff5 100644
--- a/drivers/char/tpm/tpm2_key.c
+++ b/drivers/char/tpm/tpm2_key.c
@@ -32,16 +32,23 @@ int tpm2_key_type(void *context, size_t hdrlen,
const void *value, size_t vlen)
{
enum OID oid = look_up_OID(value, vlen);
-
- if (oid != OID_TPMSealedData) {
+ struct tpm2_key *key = context;
+
+ switch (oid) {
+ case OID_TPMSealedData:
+ pr_debug("TPMSealedData\n");
+ break;
+ case OID_TPMLoadableKey:
+ pr_debug("TPMLodableKey\n");
+ break;
+ default:
char buffer[50];
-
sprint_oid(value, vlen, buffer, sizeof(buffer));
- pr_debug("OID is \"%s\" which is not TPMSealedData\n",
- buffer);
+ pr_debug("Unknown OID \"%s\"\n", buffer);
return -EINVAL;
}

+ key->oid = oid;
return 0;
}

diff --git a/include/crypto/tpm2_key.h b/include/crypto/tpm2_key.h
index acf41b2e0c92..2d2434233000 100644
--- a/include/crypto/tpm2_key.h
+++ b/include/crypto/tpm2_key.h
@@ -2,12 +2,14 @@
#ifndef __LINUX_TPM2_KEY_H__
#define __LINUX_TPM2_KEY_H__

+#include <linux/oid_registry.h>
#include <linux/slab.h>

/*
* TPM2 ASN.1 key
*/
struct tpm2_key {
+ enum OID oid;
u32 parent;
const u8 *blob;
u32 blob_len;
diff --git a/security/keys/trusted-keys/trusted_tpm2.c b/security/keys/trusted-keys/trusted_tpm2.c
index e0bd1a2fc2ca..5b4555dd13e5 100644
--- a/security/keys/trusted-keys/trusted_tpm2.c
+++ b/security/keys/trusted-keys/trusted_tpm2.c
@@ -303,6 +303,10 @@ static int tpm2_load_cmd(struct tpm_chip *chip,
payload->old_format = 1;
} else {
blob = key.blob;
+ if (key.oid != OID_TPMSealedData) {
+ tpm2_key_destroy(&key);
+ return -EINVAL;
+ }
}

if (!blob)
--
2.45.1