From: Jason Gunthorpe <jgg@ziepe.ca>
To: Shirish S <shirish.s@amd.com>
Cc: linux-integrity@vger.kernel.org, Peter Huewe <peterhuewe@gmx.de>,
Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>,
Arnd Bergmann <arnd@arndb.de>,
Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
open list <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] tpm: Fix NULL pointer dereference in tpm_transmit()
Date: Wed, 4 Jul 2018 08:43:44 -0600 [thread overview]
Message-ID: <20180704144344.GA30037@ziepe.ca> (raw)
In-Reply-To: <1530695020-21888-1-git-send-email-shirish.s@amd.com>
On Wed, Jul 04, 2018 at 02:33:40PM +0530, Shirish S wrote:
> During system shutdown,
> tpm_class_shutdown() when called with TPM_CHIP_FLAG_TPM2
> flag set, makes chip->ops NULL.
>
> However tpm_chip_unregister() called later in shutdown
> sequence tries to access chip->ops in tpm_try_transmit()
> leading the NULL pointer dereference.
>
> This patch fixes this issue.
> Below is the trace for reference:
>
> BUG: unable to handle kernel NULL pointer dereference at
> 0000000000000048
> IP: tpm_transmit+0x267/0x565
> PGD 0 P4D 0
> Oops: 0000 [#1] PREEMPT SMP NOPTI
> ...
> task: ffff937c847fe580 task.stack: ffffa79f80b04000
> RIP: 0010:tpm_transmit+0x267/0x565
> RSP: 0018:ffffa79f80b07c08 EFLAGS: 00010286
> RAX: 0000000000000000 RBX: ffff937ca9bc8000 RCX: ffff937c847fe580
> RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffffffff98e3cd40
> RBP: ffffa79f80b07c88 R08: 000000000001fff4 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000000 R12: ffffa79f80b07cd4
> R13: 000000000000008c R14: ffffffffffffffc3 R15: 0000000000000000
> FS: 00007ef31f747740(0000) GS:ffff937caed00000(0000)
> knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 0000000000000048 CR3: 00000001243d2000 CR4: 00000000001406e0
> Call Trace:
> tpm_transmit_cmd+0x25/0x70
> tpm2_shutdown+0x69/0xa3
> ? __radix_tree_replace+0xd9/0x120
> ? idr_replace_ext+0x92/0xb6
> tpm_chip_unregister+0xaa/0xdb
> cr50_i2c_shutdown+0x1e/0x41
It makes no sense to call something like tpm_unregister from shutdown.
Jason
next prev parent reply other threads:[~2018-07-04 14:43 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-07-04 9:03 [PATCH] tpm: Fix NULL pointer dereference in tpm_transmit() Shirish S
2018-07-04 14:43 ` Jason Gunthorpe [this message]
2018-07-04 17:13 ` Jarkko Sakkinen
2018-07-05 3:59 ` S, Shirish
2018-07-05 15:21 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180704144344.GA30037@ziepe.ca \
--to=jgg@ziepe.ca \
--cc=arnd@arndb.de \
--cc=gregkh@linuxfoundation.org \
--cc=jarkko.sakkinen@linux.intel.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=peterhuewe@gmx.de \
--cc=shirish.s@amd.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.