linux-integrity.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Tyler Hicks <tyhicks@linux.microsoft.com>
To: Jens Wiklander <jens.wiklander@linaro.org>,
	Allen Pais <apais@linux.microsoft.com>,
	Sumit Garg <sumit.garg@linaro.org>,
	Peter Huewe <peterhuewe@gmx.de>,
	Jarkko Sakkinen <jarkko@kernel.org>,
	Jason Gunthorpe <jgg@ziepe.ca>,
	Vikas Gupta <vikas.gupta@broadcom.com>
Cc: "Thirupathaiah Annapureddy" <thiruan@microsoft.com>,
	"Pavel Tatashin" <pasha.tatashin@soleen.com>,
	"Rafał Miłecki" <zajec5@gmail.com>,
	op-tee@lists.trustedfirmware.org,
	linux-integrity@vger.kernel.org,
	bcm-kernel-feedback-list@broadcom.com,
	linux-mips@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH v5 7/8] tpm_ftpm_tee: Free and unregister TEE shared memory during kexec
Date: Mon, 14 Jun 2021 17:33:16 -0500	[thread overview]
Message-ID: <20210614223317.999867-8-tyhicks@linux.microsoft.com> (raw)
In-Reply-To: <20210614223317.999867-1-tyhicks@linux.microsoft.com>

dma-buf backed shared memory cannot be reliably freed and unregistered
during a kexec operation even when tee_shm_free() is called on the shm
from a .shutdown hook. The problem occurs because dma_buf_put() calls
fput() which then uses task_work_add(), with the TWA_RESUME parameter,
to queue tee_shm_release() to be called before the current task returns
to user mode. However, the current task never returns to user mode
before the kexec completes so the memory is never freed nor
unregistered.

Use tee_shm_alloc_kernel_buf() to avoid dma-buf backed shared memory
allocation so that tee_shm_free() can directly call tee_shm_release().
This will ensure that the shm can be freed and unregistered during a
kexec operation.

Fixes: 09e574831b27 ("tpm/tpm_ftpm_tee: A driver for firmware TPM running inside TEE")
Fixes: 1760eb689ed6 ("tpm/tpm_ftpm_tee: add shutdown call back")
Cc: stable@vger.kernel.org
Signed-off-by: Tyler Hicks <tyhicks@linux.microsoft.com>
---
 drivers/char/tpm/tpm_ftpm_tee.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/char/tpm/tpm_ftpm_tee.c b/drivers/char/tpm/tpm_ftpm_tee.c
index 2ccdf8ac6994..6e3235565a4d 100644
--- a/drivers/char/tpm/tpm_ftpm_tee.c
+++ b/drivers/char/tpm/tpm_ftpm_tee.c
@@ -254,11 +254,11 @@ static int ftpm_tee_probe(struct device *dev)
 	pvt_data->session = sess_arg.session;
 
 	/* Allocate dynamic shared memory with fTPM TA */
-	pvt_data->shm = tee_shm_alloc(pvt_data->ctx,
-				      MAX_COMMAND_SIZE + MAX_RESPONSE_SIZE,
-				      TEE_SHM_MAPPED | TEE_SHM_DMA_BUF);
+	pvt_data->shm = tee_shm_alloc_kernel_buf(pvt_data->ctx,
+						 MAX_COMMAND_SIZE +
+						 MAX_RESPONSE_SIZE);
 	if (IS_ERR(pvt_data->shm)) {
-		dev_err(dev, "%s: tee_shm_alloc failed\n", __func__);
+		dev_err(dev, "%s: tee_shm_alloc_kernel_buf failed\n", __func__);
 		rc = -ENOMEM;
 		goto out_shm_alloc;
 	}
-- 
2.25.1


  parent reply	other threads:[~2021-06-14 22:33 UTC|newest]

Thread overview: 17+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-14 22:33 [PATCH v5 0/8] tee: Improve support for kexec and kdump Tyler Hicks
2021-06-14 22:33 ` [PATCH v5 1/8] optee: Fix memory leak when failing to register shm pages Tyler Hicks
2021-06-14 22:33 ` [PATCH v5 2/8] optee: Refuse to load the driver under the kdump kernel Tyler Hicks
2021-06-14 22:33 ` [PATCH v5 3/8] optee: fix tee out of memory failure seen during kexec reboot Tyler Hicks
2021-06-14 22:33 ` [PATCH v5 4/8] optee: Clear stale cache entries during initialization Tyler Hicks
2021-06-15  7:00   ` Jens Wiklander
2021-06-14 22:33 ` [PATCH v5 5/8] tee: add tee_shm_alloc_kernel_buf() Tyler Hicks
2021-06-14 22:33 ` [PATCH v5 6/8] tee: Correct inappropriate usage of TEE_SHM_DMA_BUF flag Tyler Hicks
2021-06-15  7:10   ` Jens Wiklander
2021-06-14 22:33 ` Tyler Hicks [this message]
2021-06-14 22:33 ` [PATCH v5 8/8] firmware: tee_bnxt: Release TEE shm, session, and context during kexec Tyler Hicks
2021-06-15  4:32 ` [PATCH v5 0/8] tee: Improve support for kexec and kdump Sumit Garg
2021-06-15  4:34   ` Tyler Hicks
2021-06-15  7:23 ` Jens Wiklander
2021-06-15 13:37   ` Tyler Hicks
2021-06-15 14:15     ` Florian Fainelli
2021-07-21  6:03       ` Jens Wiklander

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20210614223317.999867-8-tyhicks@linux.microsoft.com \
    --to=tyhicks@linux.microsoft.com \
    --cc=apais@linux.microsoft.com \
    --cc=bcm-kernel-feedback-list@broadcom.com \
    --cc=jarkko@kernel.org \
    --cc=jens.wiklander@linaro.org \
    --cc=jgg@ziepe.ca \
    --cc=linux-integrity@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mips@vger.kernel.org \
    --cc=op-tee@lists.trustedfirmware.org \
    --cc=pasha.tatashin@soleen.com \
    --cc=peterhuewe@gmx.de \
    --cc=sumit.garg@linaro.org \
    --cc=thiruan@microsoft.com \
    --cc=vikas.gupta@broadcom.com \
    --cc=zajec5@gmail.com \
    --subject='Re: [PATCH v5 7/8] tpm_ftpm_tee: Free and unregister TEE shared memory during kexec' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).