This is a note to let you know that I've just added the patch titled tpm_ftpm_tee: Free and unregister TEE shared memory during kexec to the 5.13-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tpm_ftpm_tee-free-and-unregister-tee-shared-memory-during-kexec.patch and it can be found in the queue-5.13 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From dfb703ad2a8d366b829818a558337be779746575 Mon Sep 17 00:00:00 2001 From: Tyler Hicks <tyhicks@xxxxxxxxxxxxxxxxxxx> Date: Mon, 14 Jun 2021 17:33:16 -0500 Subject: tpm_ftpm_tee: Free and unregister TEE shared memory during kexec From: Tyler Hicks <tyhicks@xxxxxxxxxxxxxxxxxxx> commit dfb703ad2a8d366b829818a558337be779746575 upstream. dma-buf backed shared memory cannot be reliably freed and unregistered during a kexec operation even when tee_shm_free() is called on the shm from a .shutdown hook. The problem occurs because dma_buf_put() calls fput() which then uses task_work_add(), with the TWA_RESUME parameter, to queue tee_shm_release() to be called before the current task returns to user mode. However, the current task never returns to user mode before the kexec completes so the memory is never freed nor unregistered. Use tee_shm_alloc_kernel_buf() to avoid dma-buf backed shared memory allocation so that tee_shm_free() can directly call tee_shm_release(). This will ensure that the shm can be freed and unregistered during a kexec operation. Fixes: 09e574831b27 ("tpm/tpm_ftpm_tee: A driver for firmware TPM running inside TEE") Fixes: 1760eb689ed6 ("tpm/tpm_ftpm_tee: add shutdown call back") Cc: stable@xxxxxxxxxxxxxxx Signed-off-by: Tyler Hicks <tyhicks@xxxxxxxxxxxxxxxxxxx> Reviewed-by: Sumit Garg <sumit.garg@xxxxxxxxxx> Acked-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx> Signed-off-by: Jens Wiklander <jens.wiklander@xxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- drivers/char/tpm/tpm_ftpm_tee.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/char/tpm/tpm_ftpm_tee.c +++ b/drivers/char/tpm/tpm_ftpm_tee.c @@ -254,11 +254,11 @@ static int ftpm_tee_probe(struct device pvt_data->session = sess_arg.session; /* Allocate dynamic shared memory with fTPM TA */ - pvt_data->shm = tee_shm_alloc(pvt_data->ctx, - MAX_COMMAND_SIZE + MAX_RESPONSE_SIZE, - TEE_SHM_MAPPED | TEE_SHM_DMA_BUF); + pvt_data->shm = tee_shm_alloc_kernel_buf(pvt_data->ctx, + MAX_COMMAND_SIZE + + MAX_RESPONSE_SIZE); if (IS_ERR(pvt_data->shm)) { - dev_err(dev, "%s: tee_shm_alloc failed\n", __func__); + dev_err(dev, "%s: tee_shm_alloc_kernel_buf failed\n", __func__); rc = -ENOMEM; goto out_shm_alloc; } Patches currently in stable-queue which might be from tyhicks@xxxxxxxxxxxxxxxxxxx are queue-5.13/optee-clear-stale-cache-entries-during-initialization.patch queue-5.13/tee-correct-inappropriate-usage-of-tee_shm_dma_buf-flag.patch queue-5.13/optee-fix-memory-leak-when-failing-to-register-shm-pages.patch queue-5.13/optee-fix-tee-out-of-memory-failure-seen-during-kexec-reboot.patch queue-5.13/tpm_ftpm_tee-free-and-unregister-tee-shared-memory-during-kexec.patch queue-5.13/tee-add-tee_shm_alloc_kernel_buf.patch queue-5.13/optee-refuse-to-load-the-driver-under-the-kdump-kernel.patch