Re: [PATCH 1/2] keys/trusted_keys: return immediately after TPM unseal failure

On Thu, Sep 03, 2026 at 03:54:38AM +0530, Srish Srinivasan wrote:

On 9/2/26 4:01 PM, Srish Srinivasan wrote:

quoted

trusted_tpm_unseal() proceeds to pcrlock() when the TPM unseal operation
fails. If pcrlock() succeeds, its return value overwrites the unseal error,
causing key instantiation to succeed.

Return immediately when unseal fails to preserve the original error.

Fixes: 5d0682be3189 ("KEYS: trusted: Add generic trusted keys framework")
Cc: stable@vger.kernel.org
Signed-off-by: Srish Srinivasan <ssrish@linux.ibm.com>
---
  security/keys/trusted-keys/trusted_tpm1.c | 4 +++-
  1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/security/keys/trusted-keys/trusted_tpm1.c b/security/keys/trusted-keys/trusted_tpm1.c
index bf0bf7f36970..1168ca235205 100644
--- a/security/keys/trusted-keys/trusted_tpm1.c
+++ b/security/keys/trusted-keys/trusted_tpm1.c

@@ -923,8 +923,10 @@ static int trusted_tpm_unseal(struct trusted_key_payload *p, char *datablob)
  		ret = tpm2_unseal_trusted(chip, p, options);
  	else
  		ret = key_unseal(p, options);
-	if (ret < 0)
+	if (ret < 0) {
  		pr_info("key_unseal failed (%d)\n", ret);
+		return ret;

This should be "goto out;"
will fix this in my next version

OK, remove my reviewed-by from 1/2 so that I remember to check it
properly

quoted

+	}
  	if (options->pcrlock) {
  		ret = pcrlock(options->pcrlock);

You can retain r-by in 2/2.


BR, Jarkko