Messages in this thread Patch in this message | | | From | Andrey Pronin <> | Subject | [PATCH] tpm: avoid accessing cleared ops during shutdown | Date | Thu, 9 Jul 2020 17:22:09 -0700 |
| |
This patch prevents NULL dereferencing when using chip->ops while sending TPM2_Shutdown command if both tpm_class_shutdown handler and tpm_del_char_device are called during system shutdown.
Both these handlers set chip->ops to NULL but don't check if it's already NULL when they are called before using it.
This issue was revealed in Chrome OS after a recent set of changes to the unregister order for spi controllers, such as: b4c6230bb0ba spi: Fix controller unregister order f40913d2dca1 spi: pxa2xx: Fix controller unregister order and similar for other controllers.
Signed-off-by: Andrey Pronin <apronin@chromium.org> --- drivers/char/tpm/tpm-chip.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c index 8c77e88012e9..a410ca40a3c5 100644 --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -296,7 +296,7 @@ static int tpm_class_shutdown(struct device *dev) struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev); down_write(&chip->ops_sem); - if (chip->flags & TPM_CHIP_FLAG_TPM2) { + if (chip->ops && (chip->flags & TPM_CHIP_FLAG_TPM2)) { if (!tpm_chip_start(chip)) { tpm2_shutdown(chip, TPM2_SU_CLEAR); tpm_chip_stop(chip); @@ -479,7 +479,7 @@ static void tpm_del_char_device(struct tpm_chip *chip) /* Make the driver uncallable. */ down_write(&chip->ops_sem); - if (chip->flags & TPM_CHIP_FLAG_TPM2) { + if (chip->ops && (chip->flags & TPM_CHIP_FLAG_TPM2)) { if (!tpm_chip_start(chip)) { tpm2_shutdown(chip, TPM2_SU_CLEAR); tpm_chip_stop(chip); -- 2.25.1
| |