Lino Sanfilippo 7e0438f83d tpm: fix reference counting for struct tpm_chip ... The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM command to the file descriptor opened at step 1. ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4 refcount_t: addition on 0; use-after-free. Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4 brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835] CPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2 Hardware name: BCM2711 [<c0410c3c>] (unwind_backtrace) from [<c040b580>] (show_stack+0x10/0x14) [<c040b580>] (show_stack) from [<c1092174>] (dump_stack+0xc4/0xd8) [<c1092174>] (dump_stack) from [<c0445a30>] (__warn+0x104/0x108) [<c0445a30>] (__warn) from [<c0445aa8>] (warn_slowpath_fmt+0x74/0xb8) [<c0445aa8>] (warn_slowpath_fmt) from [<c08435d0>] (kobject_get+0xa0/0xa4) [<c08435d0>] (kobject_get) from [<bf0a715c>] (tpm_try_get_ops+0x14/0x54 [tpm]) [<bf0a715c>] (tpm_try_get_ops [tpm]) from [<bf0a7d6c>] (tpm_common_write+0x38/0x60 [tpm]) [<bf0a7d6c>] (tpm_common_write [tpm]) from [<c05a7ac0>] (vfs_write+0xc4/0x3c0) [<c05a7ac0>] (vfs_write) from [<c05a7ee4>] (ksys_write+0x58/0xcc) [<c05a7ee4>] (ksys_write) from [<c04001a0>] (ret_fast_syscall+0x0/0x4c) Exception stack(0xc226bfa8 to 0xc226bff0) bfa0: 00000000 000105b4 00000003 beafe664 00000014 00000000 bfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe684 bfe0: 0000006c beafe648 0001056c b6eb6944 ---[ end trace d4b8409def9b8b1f ]--- The reason for this warning is the attempt to get the chip->dev reference in tpm_common_write() although the reference counter is already zero. Since commit 8979b02aaf ("tpm: Fix reference count to main device") the extra reference used to prevent a premature zero counter is never taken, because the required TPM_CHIP_FLAG_TPM2 flag is never set. Fix this by moving the TPM 2 character device handling from tpm_chip_alloc() to tpm_add_char_device() which is called at a later point in time when the flag has been set in case of TPM2. Commit fdc915f7f7 ("tpm: expose spaces via a device link /dev/tpmrm<n>") already introduced function tpm_devs_release() to release the extra reference but did not implement the required put on chip->devs that results in the call of this function. Fix this by putting chip->devs in tpm_chip_unregister(). Finally move the new implementation for the TPM 2 handling into a new function to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the good case and error cases. Cc: stable@vger.kernel.org Fixes: fdc915f7f7 ("tpm: expose spaces via a device link /dev/tpmrm<n>") Fixes: 8979b02aaf ("tpm: Fix reference count to main device") Co-developed-by: Jason Gunthorpe <jgg@ziepe.ca> Signed-off-by: Jason Gunthorpe <jgg@ziepe.ca> Signed-off-by: Lino Sanfilippo <LinoSanfilippo@gmx.de> Tested-by: Stefan Berger <stefanb@linux.ibm.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>		2022-03-08 13:55:52 +02:00
..
eventlog	tpm: vtpm_proxy: Avoid reading host log when using a virtual device	2021-04-14 16:30:30 +03:00
st33zp24	tpm/st33zp24: drop unneeded over-commenting	2022-01-09 00:18:37 +02:00
Kconfig	tpm: tis: Kconfig: Add helper dependency on COMPILE_TEST	2021-10-26 05:03:33 +03:00
Makefile	char: tpm: add i2c driver for cr50	2021-02-16 10:40:27 +02:00
tpm-chip.c	tpm: fix reference counting for struct tpm_chip	2022-03-08 13:55:52 +02:00
tpm-dev-common.c	tpm: Fix error handling in async work	2022-03-08 10:33:17 +02:00
tpm-dev.c
tpm-dev.h
tpm-interface.c
tpm-sysfs.c	tpm: Add Upgrade/Reduced mode support for TPM2 modules	2022-01-09 00:18:47 +02:00
tpm.h	tpm: fix reference counting for struct tpm_chip	2022-03-08 13:55:52 +02:00
tpm1-cmd.c	tpm: fix some doc warnings in tpm1-cmd.c	2021-06-23 16:51:03 +03:00
tpm2-cmd.c	tpm: Add Upgrade/Reduced mode support for TPM2 modules	2022-01-09 00:18:47 +02:00
tpm2-space.c	tpm: fix reference counting for struct tpm_chip	2022-03-08 13:55:52 +02:00
tpm_atmel.c
tpm_atmel.h
tpm_crb.c	tpm_crb: Use IOMEM_ERR_PTR when function returns iomem	2021-06-23 16:51:03 +03:00
tpm_ftpm_tee.c	tpm_ftpm_tee: Free and unregister TEE shared memory during kexec	2021-07-21 07:55:50 +02:00
tpm_ftpm_tee.h
tpm_i2c_atmel.c
tpm_i2c_infineon.c
tpm_i2c_nuvoton.c
tpm_ibmvtpm.c	tpm: ibmvtpm: Avoid error message when process gets signal while waiting	2021-08-23 19:55:42 +03:00
tpm_ibmvtpm.h	tpm: ibmvtpm: Avoid error message when process gets signal while waiting	2021-08-23 19:55:42 +03:00
tpm_infineon.c
tpm_nsc.c
tpm_ppi.c	tpm/ppi: Constify static struct attribute_group	2021-02-16 10:40:27 +02:00
tpm_tis.c	tpm_tis: Use DEFINE_RES_MEM() to simplify code	2021-06-23 16:51:03 +03:00
tpm_tis_core.c	tpm: fix NPE on probe for missing device	2022-01-09 00:18:51 +02:00
tpm_tis_core.h	tpm: fix Atmel TPM crash caused by too frequent queries	2021-10-26 05:03:34 +03:00
tpm_tis_i2c_cr50.c	char: tpm: cr50: Set TPM_FIRMWARE_POWER_MANAGED based on device property	2022-01-09 00:18:45 +02:00
tpm_tis_spi.h
tpm_tis_spi_cr50.c	char: tpm: cr50: Set TPM_FIRMWARE_POWER_MANAGED based on device property	2022-01-09 00:18:45 +02:00
tpm_tis_spi_main.c	tpm_tis_spi: Add missing SPI ID	2021-10-26 05:03:34 +03:00
tpm_tis_synquacer.c
tpm_vtpm_proxy.c
tpmrm-dev.c
xen-tpmfront.c	tpm: xen-tpmfront: Use struct_size() helper	2022-03-08 10:33:18 +02:00