Date: Thu, 6 Mar 2025 15:15:39 +0000
From: Jonathan McDowell <noodles@earth.li>
To: James Bottomley <James.Bottomley@hansenpartnership.com>,
	Jarkko Sakkinen <jarkko@kernel.org>
Cc: linux-integrity@vger.kernel.org
Subject: Unbalanced TPM2 HMAC session calls
Message-ID: <Z8m8G0RfiRyYGH_t@earth.li>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline

We're seeing a lot of:

tpm tpm0: auth session is active

messages in our logs. This is emitted (once per boot) by 
tpm2_start_auth_session() if the auth sessions is already active when it 
is called.

Investigating I think this is because tpm2_pcr_extend() calls 
tpm_buf_append_hmac_session() which sets TPM2_SA_CONTINUE_SESSION so 
tpm_buf_check_hmac_response() does not cleanup the auth session, but 
then doesn't call tpm2_end_auth_session().

Looking at tpm2_get_random() it uses TPM2_SA_CONTINUE_SESSION but *also* 
cleans up with tpm2_end_auth_session().

I'd be sending a patch proposing the addition of tpm2_end_auth_session() 
to the end of tpm2_pcr_extend() but I recall a bunch of discussion 
about trying to cache the HMAC session to improve IMA performance, so I 
don't know if perhaps we should be dropping the warning instead?

(As an aside, I'm not clear dropping the warning is enough, as I can't 
see where the session otherwise gets cleaned up other than by accident 
when the RNG tries to get more randomness.)

J.

-- 
I've got a trigger inside.