tpm: Address !chip->auth in tpm2_*_auth_session()

Unless tpm_chip_bootstrap() was called by the driver, !chip->auth can cause
a null derefence in tpm2_*_auth_session(). Thus, address !chip->auth in
tpm2_*_auth_session().

Cc: stable@vger.kernel.org # v6.9+
Reported-by: Stefan Berger <stefanb@linux.ibm.com>
Closes: https://lore.kernel.org/linux-integrity/20240617193408.1234365-1-stefanb@linux.ibm.com/
Fixes: 699e3efd6c64 ("tpm: Add HMAC session start and end functions")
Tested-by: Michael Ellerman <mpe@ellerman.id.au> # ppc
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

diff --git a/drivers/char/tpm/tpm2-sessions.c b/drivers/char/tpm/tpm2-sessions.c
index 907ac9956a78f02fee74aead24236ce664133b87..2f1d96a5a5a76d459780707d7ebda6871e15f4d6 100644 (file)
--- a/drivers/char/tpm/tpm2-sessions.c
+++ b/drivers/char/tpm/tpm2-sessions.c
@@ -824,8 +824,13 @@ EXPORT_SYMBOL(tpm_buf_check_hmac_response);
  */
 void tpm2_end_auth_session(struct tpm_chip *chip)
 {
-       tpm2_flush_context(chip, chip->auth->handle);
-       memzero_explicit(chip->auth, sizeof(*chip->auth));
+       struct tpm2_auth *auth = chip->auth;
+
+       if (!auth)
+               return;
+
+       tpm2_flush_context(chip, auth->handle);
+       memzero_explicit(auth, sizeof(*auth));
 }
 EXPORT_SYMBOL(tpm2_end_auth_session);
 
@@ -907,6 +912,11 @@ int tpm2_start_auth_session(struct tpm_chip *chip)
        int rc;
        u32 null_key;
 
+       if (!auth) {
+               dev_warn_once(&chip->dev, "auth session is not active\n");
+               return 0;
+       }
+
        rc = tpm2_load_null(chip, &null_key);
        if (rc)
                goto out;