Re: [PATCH v3] tpm: flush timeout work outside buffer_mutex to avoid deadlock

[Jarkko Sakkinen <jarkko@kernel.org>]

On Mon, Nov 09, 2026 at 01:58:12AM +0900, hyunjungg wrote:
> From: Hyunjung Ko <hj351016@gmail.com>
> 
> tpm_common_read() calls flush_work(&priv->timeout_work) under
> priv->buffer_mutex, but tpm_timeout_work() also takes buffer_mutex, so a
> running timeout work deadlocks the flush. Flush after unlocking; the timer
> is deleted under the lock, so no new work can be queued.
> 
> Fixes: 9488585b21be ("tpm: add support for partial reads")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hyunjung Ko <hj351016@gmail.com>
> ---
> v3: Trim the commit message to the essentials per Jarkko's review.
>     No functional change (same as v2).
>  drivers/char/tpm/tpm-dev-common.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c
> index 6569212..ee91f45 100644
> --- a/drivers/char/tpm/tpm-dev-common.c
> +++ b/drivers/char/tpm/tpm-dev-common.c
> @@ -132,6 +132,7 @@ ssize_t tpm_common_read(struct file *file, char __user *buf,
>  {
>  	struct file_priv *priv = file->private_data;
>  	ssize_t ret_size = 0;
> +	bool flush = false;
>  	int rc;
>  
>  	if (!size)
> @@ -164,9 +165,18 @@ out:
>  	if (!priv->response_length) {
>  		*off = 0;
>  		timer_delete_sync(&priv->user_read_timer);
> -		flush_work(&priv->timeout_work);
> +		flush = true;
>  	}
>  	mutex_unlock(&priv->buffer_mutex);
> +
> +	/*
> +	 * tpm_timeout_work() takes buffer_mutex, so flush it after dropping
> +	 * the mutex to avoid a deadlock; the timer is deleted above, so no new
> +	 * timeout work can be queued once the mutex is released.
> +	 */
> +	if (flush)
> +		flush_work(&priv->timeout_work);
> +
>  	return ret_size;
>  }
>  
> -- 
> 2.43.0
> 

Ok, let's apply this, thank you.

Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>

Br, Jarkko