From: Sachin Sant <sachinp@linux.vnet.ibm.com>
To: Stefan Berger <stefanb@linux.ibm.com>
Cc: jarkko@kernel.org, peterhuewe@gmx.de,
linux-integrity@vger.kernel.org, Korrapati.Likhitha@ibm.com,
pavrampu@in.ibm.com, linux-kernel@vger.kernel.org, jgg@ziepe.ca,
linux-security-module@vger.kernel.org, gcwilson@us.ibm.com,
linuxppc-dev@lists.ozlabs.org
Subject: Re: [PATCH] tpm: Fix kexec crash due to access to ops NULL pointer (powerpc)
Date: Mon, 20 Dec 2021 10:47:13 +0530 [thread overview]
Message-ID: <B816AE7F-E224-4203-9B21-99310D49040D@linux.vnet.ibm.com> (raw)
In-Reply-To: <20211212012804.1555661-1-stefanb@linux.ibm.com>
> On 12-Dec-2021, at 6:58 AM, Stefan Berger <stefanb@linux.ibm.com> wrote:
>
> Fix the following crash on kexec by checking chip->ops for a NULL pointer
> in tpm_chip_start() and returning an error code if this is the case.
>
> BUG: Kernel NULL pointer dereference on read at 0x00000060
> Faulting instruction address: 0xc00000000099a06c
> Oops: Kernel access of bad area, sig: 11 [#1]
> ...
> NIP [c00000000099a06c] tpm_chip_start+0x2c/0x140
> LR [c00000000099a808] tpm_chip_unregister+0x108/0x170
> Call Trace:
> [c0000000188bfa00] [c000000002b03930] fw_devlink_strict+0x0/0x8 (unreliable)
> [c0000000188bfa30] [c00000000099a808] tpm_chip_unregister+0x108/0x170
> [c0000000188bfa70] [c0000000009a3874] tpm_ibmvtpm_remove+0x34/0x130
> [c0000000188bfae0] [c000000000110dbc] vio_bus_remove+0x5c/0xb0
> [c0000000188bfb20] [c0000000009bc154] device_shutdown+0x1d4/0x3a8
> [c0000000188bfbc0] [c000000000196e14] kernel_restart_prepare+0x54/0x70
>
> The referenced patch below introduced a function to shut down the VIO bus.
> The bus shutdown now calls tpm_del_char_device (via tpm_chip_unregister)
> after a call to tpm_class_shutdown, which already set chip->ops to NULL.
> The crash occurrs when tpm_del_char_device calls tpm_chip_start with the
> chip->ops NULL pointer.
>
> Fixes: 39d0099f9439 ("powerpc/pseries: Add shutdown() to vio_driver and vio_bus")
> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> ---
With the patch applied, kexec with vTPM works as expected.
Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Thanks
-Sachin
WARNING: multiple messages have this Message-ID (diff)
From: Sachin Sant <sachinp@linux.vnet.ibm.com>
To: Stefan Berger <stefanb@linux.ibm.com>
Cc: Korrapati.Likhitha@ibm.com, pavrampu@in.ibm.com,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org, jgg@ziepe.ca, jarkko@kernel.org,
gcwilson@us.ibm.com, linux-integrity@vger.kernel.org,
linuxppc-dev@lists.ozlabs.org, peterhuewe@gmx.de
Subject: Re: [PATCH] tpm: Fix kexec crash due to access to ops NULL pointer (powerpc)
Date: Mon, 20 Dec 2021 10:47:13 +0530 [thread overview]
Message-ID: <B816AE7F-E224-4203-9B21-99310D49040D@linux.vnet.ibm.com> (raw)
In-Reply-To: <20211212012804.1555661-1-stefanb@linux.ibm.com>
> On 12-Dec-2021, at 6:58 AM, Stefan Berger <stefanb@linux.ibm.com> wrote:
>
> Fix the following crash on kexec by checking chip->ops for a NULL pointer
> in tpm_chip_start() and returning an error code if this is the case.
>
> BUG: Kernel NULL pointer dereference on read at 0x00000060
> Faulting instruction address: 0xc00000000099a06c
> Oops: Kernel access of bad area, sig: 11 [#1]
> ...
> NIP [c00000000099a06c] tpm_chip_start+0x2c/0x140
> LR [c00000000099a808] tpm_chip_unregister+0x108/0x170
> Call Trace:
> [c0000000188bfa00] [c000000002b03930] fw_devlink_strict+0x0/0x8 (unreliable)
> [c0000000188bfa30] [c00000000099a808] tpm_chip_unregister+0x108/0x170
> [c0000000188bfa70] [c0000000009a3874] tpm_ibmvtpm_remove+0x34/0x130
> [c0000000188bfae0] [c000000000110dbc] vio_bus_remove+0x5c/0xb0
> [c0000000188bfb20] [c0000000009bc154] device_shutdown+0x1d4/0x3a8
> [c0000000188bfbc0] [c000000000196e14] kernel_restart_prepare+0x54/0x70
>
> The referenced patch below introduced a function to shut down the VIO bus.
> The bus shutdown now calls tpm_del_char_device (via tpm_chip_unregister)
> after a call to tpm_class_shutdown, which already set chip->ops to NULL.
> The crash occurrs when tpm_del_char_device calls tpm_chip_start with the
> chip->ops NULL pointer.
>
> Fixes: 39d0099f9439 ("powerpc/pseries: Add shutdown() to vio_driver and vio_bus")
> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> ---
With the patch applied, kexec with vTPM works as expected.
Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Thanks
-Sachin
next prev parent reply other threads:[~2021-12-20 5:17 UTC|newest]
Thread overview: 21+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-12-12 1:28 [PATCH] tpm: Fix kexec crash due to access to ops NULL pointer (powerpc) Stefan Berger
2021-12-12 1:28 ` Stefan Berger
2021-12-20 5:17 ` Sachin Sant [this message]
2021-12-20 5:17 ` Sachin Sant
2021-12-21 0:39 ` Tyrel Datwyler
2021-12-21 1:05 ` Stefan Berger
2021-12-21 1:13 ` Jason Gunthorpe
2021-12-21 1:13 ` Jason Gunthorpe
2021-12-21 1:31 ` Stefan Berger
2021-12-21 1:31 ` Stefan Berger
2021-12-21 1:37 ` Tyrel Datwyler
2021-12-21 1:37 ` Tyrel Datwyler
2021-12-21 1:34 ` Tyrel Datwyler
2021-12-21 8:47 ` Jarkko Sakkinen
2021-12-21 8:47 ` Jarkko Sakkinen
2021-12-21 14:01 ` Stefan Berger
2021-12-21 14:01 ` Stefan Berger
2021-12-21 14:17 ` Stefan Berger
2021-12-21 14:17 ` Stefan Berger
2021-12-29 0:10 ` Jarkko Sakkinen
2021-12-29 0:10 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=B816AE7F-E224-4203-9B21-99310D49040D@linux.vnet.ibm.com \
--to=sachinp@linux.vnet.ibm.com \
--cc=Korrapati.Likhitha@ibm.com \
--cc=gcwilson@us.ibm.com \
--cc=jarkko@kernel.org \
--cc=jgg@ziepe.ca \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=pavrampu@in.ibm.com \
--cc=peterhuewe@gmx.de \
--cc=stefanb@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.