Page MenuHomeFreeBSD

tpm20: Initialize common state before testing TIS interrupts
ClosedPublic

Authored by kbowling on Aug 26 2026, 11:45 AM.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Sep 24, 4:47 AM
Unknown Object (File)
Sat, Sep 19, 4:28 PM
Unknown Object (File)
Fri, Sep 18, 11:41 AM
Unknown Object (File)
Fri, Sep 18, 9:19 AM
Unknown Object (File)
Thu, Sep 17, 12:43 PM
Unknown Object (File)
Wed, Sep 16, 9:54 AM
Unknown Object (File)
Tue, Sep 15, 9:42 PM
Unknown Object (File)
Tue, Sep 15, 4:54 PM
Subscribers

Details

Summary
The TIS attach path tested its interrupt by transmitting GetRandom
before tpm20_init() allocated the internal command buffer.  A TPM2 FIFO
device with a usable IRQ could therefore dereference a null
internal_priv.

Initialize the common TPM2 state before running the interrupt test.
Make common cleanup safe for partially initialized devices and leave
cleanup to the attachment after tpm20_init() fails, avoiding duplicate
release of the lock, command buffer, and random-source state.

Clear the IRQ resource pointer after releasing it when interrupt-handler
setup fails so the later polling-mode detach does not release it twice.

Free the internal command allocation through its object pointer rather
than relying on its embedded buffer being the first structure member.

MFC after:      2 weeks

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

sys/dev/tpm/tpm20.c
212

This path looks like it needs a call to tpm20_priv_dtor() now that tpm20_release won't free the internal buffer with a faiure here.

sys/dev/tpm/tpm20.c
212

tpm20_release() still frees internal_priv when common_initialized is false: the branch jumps to out, which calls tpm20_priv_dtor() and clears the pointer. Both TIS and CRB attach failure paths call their detach routine after tpm20_init() fails, so the allocation is released there or I am not seeing something.

kevans added inline comments.
sys/dev/tpm/tpm20.c
212

Sigh, no, sorry- for some reason I kept skipping over the label.

This revision is now accepted and ready to land.Mon, Aug 31, 12:58 AM