From: dongshengyuan <545258830@qq.com>
Date: Fri, 24 Jul 2026 09:25:32 +0000 (+0800)
Subject: veritysetup: keep parsing after ignored NvPCR options
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=99c6f0132165160a77ba86b1ab8321e4ff5219ec;p=thirdparty%2Fsystemd.git

veritysetup: keep parsing after ignored NvPCR options

tpm2-measure-nvpcr=no and invalid NvPCR names only affect the current
comma-separated option. They returned from parse_options(), so later
options were silently skipped.

Repro:
build/systemd-veritysetup attach testvol /dev/null /no/such \
    0000000000000000000000000000000000000000000000000000000000000000 \
    tpm2-measure-nvpcr=no,root-hash-signature=relative

Before: root-hash-signature=relative was skipped, and execution continued
to the missing block-device error.

After: root-hash-signature=relative is parsed and rejected. Invalid NvPCR
names take the same continue path.

Follow-up for: 85d7fb22470e5a4b17045d9288d4e2c06ff7b2e8
---

diff --git a/src/veritysetup/veritysetup.c b/src/veritysetup/veritysetup.c
index 65f0c13c2e4..8e8543ba5b6 100644
--- a/src/veritysetup/veritysetup.c
+++ b/src/veritysetup/veritysetup.c
@@ -300,13 +300,13 @@ static int parse_options(const char *options) {
                         r = isempty(val) ? 0 : parse_boolean(val);
                         if (r == 0) {
                                 arg_tpm2_measure_nvpcr = mfree(arg_tpm2_measure_nvpcr);
-                                return 0;
+                                continue;
                         }
                         if (r > 0)
                                 val = "verity";
                         else if (!tpm2_nvpcr_name_is_valid(val)) {
                                 log_warning("Invalid NvPCR name, ignoring: %s", word);
-                                return 0;
+                                continue;
                         }
 
                         if (free_and_strdup(&arg_tpm2_measure_nvpcr, val) < 0)