Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753323AbdCOQnT (ORCPT ); Wed, 15 Mar 2017 12:43:19 -0400 Received: from mga05.intel.com ([192.55.52.43]:10492 "EHLO mga05.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753182AbdCOQnR (ORCPT ); Wed, 15 Mar 2017 12:43:17 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.36,169,1486454400"; d="scan'208";a="75752227" Date: Wed, 15 Mar 2017 18:43:10 +0200 From: Jarkko Sakkinen To: "Hon Ching(Vicky) Lo" , g@intel.com Cc: tpmdd-devel@lists.sourceforge.net, Jason Gunthorpe , Peter Huewe , Ashley Lai , Vicky Lo , linux-kernel@vger.kernel.org, stable@vger.kernel.org Subject: Re: [PATCH v2] vTPM: Fix missing NULL check Message-ID: <20170315164310.f2rlyev77nd3fsev@intel.com> References: <1489555687-27943-1-git-send-email-honclo@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <1489555687-27943-1-git-send-email-honclo@linux.vnet.ibm.com> Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo User-Agent: Mutt/1.6.2-neo (2016-08-21) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 2129 Lines: 61 On Wed, Mar 15, 2017 at 01:28:07AM -0400, Hon Ching(Vicky) Lo wrote: > The current code passes the address of tpm_chip as the argument to > dev_get_drvdata() without prior NULL check in > tpm_ibmvtpm_get_desired_dma. This resulted an oops during kernel > boot when vTPM is enabled in Power partition configured in active > memory sharing mode. > > The vio_driver's get_desired_dma() is called before the probe(), which > for vtpm is tpm_ibmvtpm_probe, and it's this latter function that > initializes the driver and set data. Attempting to get data before > the probe() caused the problem. > > This patch adds a NULL check to the tpm_ibmvtpm_get_desired_dma. > > fixes: 9e0d39d8a6a0 ("tpm: Remove useless priv field in struct tpm_vendor_specific") > Cc: > Signed-off-by: Hon Ching(Vicky) Lo Reviewed-by: Jarkko Sakkine /Jarkko > --- > drivers/char/tpm/tpm_ibmvtpm.c | 8 ++++++-- > 1 files changed, 6 insertions(+), 2 deletions(-) > > diff --git a/drivers/char/tpm/tpm_ibmvtpm.c b/drivers/char/tpm/tpm_ibmvtpm.c > index 1b9d61f..f01d083 100644 > --- a/drivers/char/tpm/tpm_ibmvtpm.c > +++ b/drivers/char/tpm/tpm_ibmvtpm.c > @@ -299,6 +299,8 @@ static int tpm_ibmvtpm_remove(struct vio_dev *vdev) > } > > kfree(ibmvtpm); > + /* For tpm_ibmvtpm_get_desired_dma */ > + dev_set_drvdata(&vdev->dev, NULL); > > return 0; > } > @@ -313,14 +315,16 @@ static int tpm_ibmvtpm_remove(struct vio_dev *vdev) > static unsigned long tpm_ibmvtpm_get_desired_dma(struct vio_dev *vdev) > { > struct tpm_chip *chip = dev_get_drvdata(&vdev->dev); > - struct ibmvtpm_dev *ibmvtpm = dev_get_drvdata(&chip->dev); > + struct ibmvtpm_dev *ibmvtpm; > > /* > * ibmvtpm initializes at probe time, so the data we are > * asking for may not be set yet. Estimate that 4K required > * for TCE-mapped buffer in addition to CRQ. > */ > - if (!ibmvtpm) > + if (chip) > + ibmvtpm = dev_get_drvdata(&chip->dev); > + else > return CRQ_RES_BUF_SIZE + PAGE_SIZE; > > return CRQ_RES_BUF_SIZE + ibmvtpm->rtce_size; > -- > 1.7.1 >