Page MenuHomeFreeBSD

tpm20: Initialize common state before testing TIS interrupts
ClosedPublic

Authored by kbowling on Wed, Aug 26, 11:45 AM.
Tags
None
Referenced Files
F170846246: D59196.id185149.diff
Mon, Sep 7, 12:24 AM
F170830878: D59196.diff
Sun, Sep 6, 9:51 PM
F170801848: D59196.diff
Sun, Sep 6, 5:41 PM
F170746238: D59196.id185667.diff
Sun, Sep 6, 9:28 AM
Unknown Object (File)
Sun, Sep 6, 1:15 AM
Unknown Object (File)
Sat, Sep 5, 3:06 PM
Unknown Object (File)
Sat, Sep 5, 1:37 PM
Unknown Object (File)
Sat, Sep 5, 1:25 PM
Subscribers

Details

Summary
The TIS attach path tested its interrupt by transmitting GetRandom
before tpm20_init() allocated the internal command buffer.  A TPM2 FIFO
device with a usable IRQ could therefore dereference a null
internal_priv.

Initialize the common TPM2 state before running the interrupt test.
Make common cleanup safe for partially initialized devices and leave
cleanup to the attachment after tpm20_init() fails, avoiding duplicate
release of the lock, command buffer, and random-source state.

Clear the IRQ resource pointer after releasing it when interrupt-handler
setup fails so the later polling-mode detach does not release it twice.

Free the internal command allocation through its object pointer rather
than relying on its embedded buffer being the first structure member.

MFC after:      2 weeks

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

sys/dev/tpm/tpm20.c
212

This path looks like it needs a call to tpm20_priv_dtor() now that tpm20_release won't free the internal buffer with a faiure here.

sys/dev/tpm/tpm20.c
212

tpm20_release() still frees internal_priv when common_initialized is false: the branch jumps to out, which calls tpm20_priv_dtor() and clears the pointer. Both TIS and CRB attach failure paths call their detach routine after tpm20_init() fails, so the allocation is released there or I am not seeing something.

kevans added inline comments.
sys/dev/tpm/tpm20.c
212

Sigh, no, sorry- for some reason I kept skipping over the label.

This revision is now accepted and ready to land.Mon, Aug 31, 12:58 AM