On Wed, Sep 02, 2026 at 03:48:39PM +0800, Jiangshan Yi wrote:
> When tpm_buf_fill_hmac_session() fails in tpm2_get_random(), the error
> path returns without calling tpm2_end_auth_session(), leaking the auth
> session. All other error paths in the function handle this correctly.
>
> Fixes: 3d9e043dab0a ("tpm-buf: Memory-safe allocations")
> Cc: [email protected]
> Signed-off-by: Jiangshan Yi <[email protected]>
> ---
> drivers/char/tpm/tpm2-cmd.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
> index 48cec39995fe..96e0e06bbbf0 100644
> --- a/drivers/char/tpm/tpm2-cmd.c
> +++ b/drivers/char/tpm/tpm2-cmd.c
> @@ -281,8 +281,10 @@ int tpm2_get_random(struct tpm_chip *chip, u8 *dest,
> size_t max)
> }
> tpm_buf_append_u16(buf, num_bytes);
> err = tpm_buf_fill_hmac_session(chip, buf);
> - if (err)
> + if (err) {
> + tpm2_end_auth_session(chip);
> return err;
> + }
>
> err = tpm_transmit_cmd(chip, buf,
> offsetof(struct tpm2_get_random_out,
> --
> 2.25.1
>
Thanks for the fix.
Reviewed-by: Jarkko Sakkinen <[email protected]>
BR, Jarkko
