linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH] tpm: fix potential NULL pointer access in tpm_del_char_device()
@ 2021-09-10 18:04 Lino Sanfilippo
  2021-09-13 20:25 ` Jarkko Sakkinen
  0 siblings, 1 reply; 9+ messages in thread
From: Lino Sanfilippo @ 2021-09-10 18:04 UTC (permalink / raw)
  To: peterhuewe, jarkko, jgg
  Cc: p.rosenberger, linux-integrity, linux-kernel, Lino Sanfilippo, stable

In tpm_del_char_device() make sure that chip->ops is still valid.
This check is needed since in case of a system shutdown
tpm_class_shutdown() has already been called and set chip->ops to NULL.
This leads to a NULL pointer access as soon as tpm_del_char_device()
tries to access chip->ops in case of TPM 2.

Fixes: dcbeab1946454 ("tpm: fix crash in tpm_tis deinitialization")
Cc: stable@vger.kernel.org
Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de>
---
 drivers/char/tpm/tpm-chip.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index ddaeceb7e109..ed1fb5d82caf 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -474,13 +474,19 @@ static void tpm_del_char_device(struct tpm_chip *chip)
 
 	/* Make the driver uncallable. */
 	down_write(&chip->ops_sem);
-	if (chip->flags & TPM_CHIP_FLAG_TPM2) {
-		if (!tpm_chip_start(chip)) {
-			tpm2_shutdown(chip, TPM2_SU_CLEAR);
-			tpm_chip_stop(chip);
+	/* Check if chip->ops is still valid since in case of a shutdown
+	 * tpm_class_shutdown() has already sent the TPM2_Shutdown command
+	 * and set chip->ops to NULL.
+	 */
+	if (chip->ops) {
+		if (chip->flags & TPM_CHIP_FLAG_TPM2) {
+			if (!tpm_chip_start(chip)) {
+				tpm2_shutdown(chip, TPM2_SU_CLEAR);
+				tpm_chip_stop(chip);
+			}
 		}
+		chip->ops = NULL;
 	}
-	chip->ops = NULL;
 	up_write(&chip->ops_sem);
 }
 

base-commit: a3fa7a101dcff93791d1b1bdb3affcad1410c8c1
-- 
2.33.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2021-09-29  8:58 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-10 18:04 [PATCH] tpm: fix potential NULL pointer access in tpm_del_char_device() Lino Sanfilippo
2021-09-13 20:25 ` Jarkko Sakkinen
2021-09-13 20:53   ` Aw: " Lino Sanfilippo
2021-09-14  0:31     ` Jarkko Sakkinen
2021-09-24 13:29       ` Lino Sanfilippo
2021-09-24 13:33         ` Jason Gunthorpe
2021-09-24 14:17           ` Lino Sanfilippo
2021-09-24 14:20             ` Jason Gunthorpe
2021-09-29  8:58               ` Lino Sanfilippo

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).