The TIS attach path tested its interrupt by transmitting GetRandom before tpm20_init() allocated the internal command buffer. A TPM2 FIFO device with a usable IRQ could therefore dereference a null internal_priv. Initialize the common TPM2 state before running the interrupt test. Make common cleanup safe for partially initialized devices and leave cleanup to the attachment after tpm20_init() fails, avoiding duplicate release of the lock, command buffer, and random-source state. Clear the IRQ resource pointer after releasing it when interrupt-handler setup fails so the later polling-mode detach does not release it twice. Free the internal command allocation through its object pointer rather than relying on its embedded buffer being the first structure member. MFC after: 2 weeks
Details
Details
Diff Detail
Diff Detail
- Repository
- rG FreeBSD src repository
- Lint
Lint Not Applicable - Unit
Tests Not Applicable
Event Timeline
| sys/dev/tpm/tpm20.c | ||
|---|---|---|
| 212 | This path looks like it needs a call to tpm20_priv_dtor() now that tpm20_release won't free the internal buffer with a faiure here. | |
| sys/dev/tpm/tpm20.c | ||
|---|---|---|
| 212 | tpm20_release() still frees internal_priv when common_initialized is false: the branch jumps to out, which calls tpm20_priv_dtor() and clears the pointer. Both TIS and CRB attach failure paths call their detach routine after tpm20_init() fails, so the allocation is released there or I am not seeing something. | |
| sys/dev/tpm/tpm20.c | ||
|---|---|---|
| 212 | Sigh, no, sorry- for some reason I kept skipping over the label. | |