[PATCH 1/2] keys/trusted_keys: return immediately after TPM unseal failure

[Jarkko Sakkinen]

On Thu, Sep 03, 2026 at 03:54:38AM +0530, Srish Srinivasan wrote:
> 
> On 9/2/26 4:01 PM, Srish Srinivasan wrote:
> > trusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation
> > fails. If pcrlock() succeeds, its return value overwrites the unseal error,
> > causing key instantiation to succeed.
> > 
> > Return immediately when unseal fails to preserve the original error.
> > 
> > Fixes: 5d0682be3189 ("KEYS: trusted: Add generic trusted keys framework")
> > Cc: stable at vger.kernel.org
> > Signed-off-by: Srish Srinivasan <ssrish at linux.ibm.com>
> > ---
> >   security/keys/trusted-keys/trusted_tpm1.c | 4 +++-
> >   1 file changed, 3 insertions(+), 1 deletion(-)
> > 
> > diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
> > index bf0bf7f36970..1168ca235205 100644
> > --- a/security/keys/trusted-keys/trusted_tpm1.c
> > +++ b/security/keys/trusted-keys/trusted_tpm1.c
> > @@ -923,8 +923,10 @@ static int trusted_tpm_unseal(struct trusted_key_payload *p, char *datablob)
> >   		ret = tpm2_unseal_trusted(chip, p, options);
> >   	else
> >   		ret = key_unseal(p, options);
> > -	if (ret < 0)
> > +	if (ret < 0) {
> >   		pr_info("key_unseal failed (%d)\n", ret);
> > +		return ret;
> 
> 
> This should be "goto out;"
> will fix this in my next version

OK, remove my reviewed-by from 1/2 so that I remember to check it
properly

> 
> 
> > +	}
> >   	if (options->pcrlock) {
> >   		ret = pcrlock(options->pcrlock);

You can retain r-by in 2/2.


BR, Jarkko