lkml.org 
[lkml]   [2022]   [Jan]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.15 673/846] tpm: fix potential NULL pointer access in tpm_del_char_device
    Date
    From: Lino Sanfilippo <LinoSanfilippo@gmx.de>

    commit eabad7ba2c752392ae50f24a795093fb115b686d upstream.

    Some SPI controller drivers unregister the controller in the shutdown
    handler (e.g. BCM2835). If such a controller is used with a TPM 2 slave
    chip->ops may be accessed when it is already NULL:

    At system shutdown the pre-shutdown handler tpm_class_shutdown() shuts down
    TPM 2 and sets chip->ops to NULL. Then at SPI controller unregistration
    tpm_tis_spi_remove() is called and eventually calls tpm_del_char_device()
    which tries to shut down TPM 2 again. Thereby it accesses chip->ops again:
    (tpm_del_char_device calls tpm_chip_start which calls tpm_clk_enable which
    calls chip->ops->clk_enable).

    Avoid the NULL pointer access by testing if chip->ops is valid and skipping
    the TPM 2 shutdown procedure in case it is NULL.

    Cc: stable@vger.kernel.org
    Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
    Fixes: 39d0099f9439 ("powerpc/pseries: Add shutdown() to vio_driver and vio_bus")
    Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
    Tested-by: Stefan Berger <stefanb@linux.ibm.com>
    Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
    Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/char/tpm/tpm-chip.c | 18 +++++++++++++-----
    1 file changed, 13 insertions(+), 5 deletions(-)

    --- a/drivers/char/tpm/tpm-chip.c
    +++ b/drivers/char/tpm/tpm-chip.c
    @@ -474,13 +474,21 @@ static void tpm_del_char_device(struct t

    /* Make the driver uncallable. */
    down_write(&chip->ops_sem);
    - if (chip->flags & TPM_CHIP_FLAG_TPM2) {
    - if (!tpm_chip_start(chip)) {
    - tpm2_shutdown(chip, TPM2_SU_CLEAR);
    - tpm_chip_stop(chip);
    +
    + /*
    + * Check if chip->ops is still valid: In case that the controller
    + * drivers shutdown handler unregisters the controller in its
    + * shutdown handler we are called twice and chip->ops to NULL.
    + */
    + if (chip->ops) {
    + if (chip->flags & TPM_CHIP_FLAG_TPM2) {
    + if (!tpm_chip_start(chip)) {
    + tpm2_shutdown(chip, TPM2_SU_CLEAR);
    + tpm_chip_stop(chip);
    + }
    }
    + chip->ops = NULL;
    }
    - chip->ops = NULL;
    up_write(&chip->ops_sem);
    }


    \
     
     \ /
      Last update: 2022-01-25 01:13    [W:4.059 / U:0.108 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site