From 16f51e2909be4714496a1bf5173489c9a7e43efb Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Sun, 26 May 2024 04:42:16 +0900 Subject: [PATCH] cryptenroll: do not pass an empty pcrlock policy Otherwise, tpm2_uneal() -> tpm2_build_sealing_policy() -> tpm2_deserialize() will trigger assertion. Prompted by #33017. --- src/cryptenroll/cryptenroll-tpm2.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/cryptenroll/cryptenroll-tpm2.c b/src/cryptenroll/cryptenroll-tpm2.c index 4e5d02a97e7..10bd8d77237 100644 --- a/src/cryptenroll/cryptenroll-tpm2.c +++ b/src/cryptenroll/cryptenroll-tpm2.c @@ -342,6 +342,8 @@ int enroll_tpm2(struct crypt_device *cd, r = tpm2_pcrlock_policy_load(pcrlock_path, &pcrlock_policy); if (r < 0) return r; + if (r == 0) + return log_error_errno(SYNTHETIC_ERRNO(ENOENT), "Couldn't find pcrlock policy %s.", pcrlock_path); any_pcr_value_specified = true; flags |= TPM2_FLAGS_USE_PCRLOCK; -- 2.47.3