On Thu, Jul 09, 2020 at 05:22:09PM -0700, Andrey Pronin wrote:
> This patch prevents NULL dereferencing when using chip->ops while
> sending TPM2_Shutdown command if both tpm_class_shutdown handler and
> tpm_del_char_device are called during system shutdown.
>
> Both these handlers set chip->ops to NULL but don't check if it's
> already NULL when they are called before using it.
>
> This issue was revealed in Chrome OS after a recent set of changes
> to the unregister order for spi controllers, such as:
> b4c6230bb0ba spi: Fix controller unregister order
> f40913d2dca1 spi: pxa2xx: Fix controller unregister order
> and similar for other controllers.
I'm not sure I fully understand the scenario. When does thi happen?
Why does not tpm_del_char_device need this? The changes listed tell
me nothing. Why they have this effect?
I'm just trying to understand whether this could be a regression or
not.
I neither understand what you mean by "and similar for other
controllers."
NAK for the reason that I don't understand what I'm merging.
/Jarkko
>
> Signed-off-by: Andrey Pronin <apronin@xxxxxxxxxxxx>
> ---
> drivers/char/tpm/tpm-chip.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
> index 8c77e88012e9..a410ca40a3c5 100644
> --- a/drivers/char/tpm/tpm-chip.c
> +++ b/drivers/char/tpm/tpm-chip.c
> @@ -296,7 +296,7 @@ static int tpm_class_shutdown(struct device *dev)
> struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev);
>
> down_write(&chip->ops_sem);
> - if (chip->flags & TPM_CHIP_FLAG_TPM2) {
> + if (chip->ops && (chip->flags & TPM_CHIP_FLAG_TPM2)) {
> if (!tpm_chip_start(chip)) {
> tpm2_shutdown(chip, TPM2_SU_CLEAR);
> tpm_chip_stop(chip);
> @@ -479,7 +479,7 @@ static void tpm_del_char_device(struct tpm_chip *chip)
>
> /* Make the driver uncallable. */
> down_write(&chip->ops_sem);
> - if (chip->flags & TPM_CHIP_FLAG_TPM2) {
> + if (chip->ops && (chip->flags & TPM_CHIP_FLAG_TPM2)) {
> if (!tpm_chip_start(chip)) {
> tpm2_shutdown(chip, TPM2_SU_CLEAR);
> tpm_chip_stop(chip);
> --
> 2.25.1
>
