Skip to contentSkip to conversation

tpm: Fix IRQ unwind ordering in TIS

PATCH In review Jason Gunthorpe 2 participants 3 messages Apr 27, 2016 – Apr 28, 2016 TPM device driver

lore
Share & tools
lore

Jason Gunthorpe

author
#0 lore raw

PATCH 1/1 tpm: Fix IRQ unwind ordering in TIS

The devm for the IRQ was placed on the chip, not the pdev. This can cause the irq to be still callable after the pdev has been cleaned up (eg priv kfree'd).

Found by CONFIG_DEBUG_SHIRQ=y

Reported-by Stefan Berger <[email protected]>
Fixes 233a065e0cd0 ("tpm: Get rid of chip->pdev")
Signed-off-by Jason Gunthorpe <jgunthorpe-ePGOBjL8dl3ta4EC/59zMFaTQe2KTcn/@public.gmane.org>
Tested-by Stefan Berger <[email protected]>
---
 drivers/char/tpm/tpm_tis.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
drivers/char/tpm/tpm_tis.c +2 -2
index a6b2d460bfc0..d88827046a42 100644
@@ -387,7 +387,7 @@ static void disable_interrupts(struct tpm_chip *chip)
 	intmask &= ~TPM_GLOBAL_INT_ENABLE;
 	iowrite32(intmask,
 		  priv->iobase + TPM_INT_ENABLE(priv->locality));
-	devm_free_irq(&chip->dev, priv->irq, chip);
+	devm_free_irq(chip->dev.parent, priv->irq, chip);
 	priv->irq = 0;
 	chip->flags &= ~TPM_CHIP_FLAG_IRQ;
 }

@@ -604,7 +604,7 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32 intmask,
 	struct priv_data *priv = dev_get_drvdata(&chip->dev);
 	u8 original_int_vec;
 
-	if (devm_request_irq(&chip->dev, irq, tis_int_handler, flags,
+	if (devm_request_irq(chip->dev.parent, irq, tis_int_handler, flags,
 			     dev_name(&chip->dev), chip) != 0) {
 		dev_info(&chip->dev, "Unable to request irq: %d for probe\n",
 			 irq);
Signature · 9 lines
2.1.4


------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager
Applications Manager provides deep performance insights into multiple tiers of
your business applications. It resolves application problems quickly and
reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
Reviewed-by on v1 1/1
#1 lore raw
Quoted 10 lines · Jason Gunthorpe

The devm for the IRQ was placed on the chip, not the pdev. This can cause the irq to be still callable after the pdev has been cleaned up (eg priv kfree'd).

Found by CONFIG_DEBUG_SHIRQ=y

Reported-by Stefan Berger <[email protected]>
Fixes 233a065e0cd0 ("tpm: Get rid of chip->pdev")
Signed-off-by Jason Gunthorpe <[email protected]>
Tested-by Stefan Berger <[email protected]>
Reviewed-by Jarkko Sakkinen <[email protected]>

/Jarkko

Quoted 24 lines

---
 drivers/char/tpm/tpm_tis.c | 4 ++--

 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/char/tpm/tpm_tis.c +1 -1
index a6b2d460bfc0..d88827046a42 100644
@@ -387,7 +387,7 @@ static void disable_interrupts(struct tpm_chip *chip)
  	intmask &= ~TPM_GLOBAL_INT_ENABLE;
  	iowrite32(intmask,
  		  priv->iobase + TPM_INT_ENABLE(priv->locality));
-	devm_free_irq(&chip->dev, priv->irq, chip);
+	devm_free_irq(chip->dev.parent, priv->irq, chip);
  	priv->irq = 0;
  	chip->flags &= ~TPM_CHIP_FLAG_IRQ;
  }

@@ -604,7 +604,7 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32
 intmask,
  	struct priv_data *priv = dev_get_drvdata(&chip->dev);
  	u8 original_int_vec;

drivers/char/tpm/tpm_tis.c +1 -1
-	if (devm_request_irq(&chip->dev, irq, tis_int_handler, flags,
+	if (devm_request_irq(chip->dev.parent, irq, tis_int_handler, flags,
Quoted 3 lines

       dev_name(&chip->dev), chip) != 0) { dev_info(&chip->dev, "Unable to request irq: %d for probe\n", irq);

--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

#2 lore raw
Quoted 12 lines · Jarkko Sakkinen
Quoted 11 lines · Jason Gunthorpe

The devm for the IRQ was placed on the chip, not the pdev. This can cause the irq to be still callable after the pdev has been cleaned up (eg priv kfree'd).

Found by CONFIG_DEBUG_SHIRQ=y

Reported-by Stefan Berger <[email protected]>
Fixes 233a065e0cd0 ("tpm: Get rid of chip->pdev")
Signed-off-by Jason Gunthorpe <[email protected]>
Tested-by Stefan Berger <[email protected]>
Quoted 1 line
Reviewed-by Jarkko Sakkinen <[email protected]>

And applied  and merged to next.

/Jarkko

Quoted 22 lines

/Jarkko

Quoted 20 lines

---
 drivers/char/tpm/tpm_tis.c | 4 ++--

 1 file changed, 2 insertions(+), 2 deletions(-)

drivers/char/tpm/tpm_tis.c +1 -1
index a6b2d460bfc0..d88827046a42 100644
@@ -387,7 +387,7 @@ static void disable_interrupts(struct tpm_chip *chip)
  	intmask &= ~TPM_GLOBAL_INT_ENABLE;
  	iowrite32(intmask,
  		  priv->iobase + TPM_INT_ENABLE(priv->locality));
-	devm_free_irq(&chip->dev, priv->irq, chip);
+	devm_free_irq(chip->dev.parent, priv->irq, chip);
  	priv->irq = 0;
  	chip->flags &= ~TPM_CHIP_FLAG_IRQ;
  }

@@ -604,7 +604,7 @@ static int tpm_tis_probe_irq_single(struct tpm_chip *chip, u32
 intmask,
Quoted 8 lines
Quoted 8 lines
drivers/char/tpm/tpm_tis.c +0 -0
  	struct priv_data *priv = dev_get_drvdata(&chip->dev);
  	u8 original_int_vec;

drivers/char/tpm/tpm_tis.c +1 -1
-	if (devm_request_irq(&chip->dev, irq, tis_int_handler, flags,
+	if (devm_request_irq(chip->dev.parent, irq, tis_int_handler, flags,

       dev_name(&chip->dev), chip) != 0) { dev_info(&chip->dev, "Unable to request irq: %d for probe\n", irq);

------------------------------------------------------------------------------
Find and fix application performance issues faster with Applications Manager Applications Manager provides deep performance insights into multiple tiers of your business applications. It resolves application problems quickly and reduces your MTTR. Get your free trial!
https://ad.doubleclick.net/ddm/clk/302982198;130105516;z
_______________________________________________
tpmdd-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tpmdd-devel