| Message ID | Zr8-QijwOpDLkol3@earth.li (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [v2] tpm: Clean up TPM space after command failure | expand |
On Fri Aug 16, 2024 at 2:55 PM EEST, Jonathan McDowell wrote: > From: Jonathan McDowell <noodles@meta.com> > > tpm_dev_transmit prepares the TPM space before attempting command > transmission. However if the command fails no rollback of this > preparation is done. This can result in transient handles being leaked > if the device is subsequently closed with no further commands performed. > > Fix this by flushing the space in the event of command transmission > failure. > > Fixes: 745b361e989a ("tpm: infrastructure for TPM spaces") > Signed-off-by: Jonathan McDowell <noodles@meta.com> > --- > v2: > - Add 'Fixes:' > - Cc James as one of the original authors > - Add space sanity check in tpm2_flush_space > > drivers/char/tpm/tpm-dev-common.c | 2 ++ > drivers/char/tpm/tpm2-space.c | 3 +++ > 2 files changed, 5 insertions(+) > > diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c > index 30b4c288c1bb..c3fbbf4d3db7 100644 > --- a/drivers/char/tpm/tpm-dev-common.c > +++ b/drivers/char/tpm/tpm-dev-common.c > @@ -47,6 +47,8 @@ static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space, > > if (!ret) > ret = tpm2_commit_space(chip, space, buf, &len); > + else > + tpm2_flush_space(chip); > > out_rc: > return ret ? ret : len; > diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c > index 4892d491da8d..25a66870c165 100644 > --- a/drivers/char/tpm/tpm2-space.c > +++ b/drivers/char/tpm/tpm2-space.c > @@ -169,6 +169,9 @@ void tpm2_flush_space(struct tpm_chip *chip) > struct tpm_space *space = &chip->work_space; > int i; > > + if (!space) > + return; > + > for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++) > if (space->context_tbl[i] && ~space->context_tbl[i]) > tpm2_flush_context(chip, space->context_tbl[i]); I'll pick this for 6.12: I think it is a legit fix but not worth of disturbing the in-progress release cycle (which is going almost rc4 already): Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> Thank you. BR, Jarkko
diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c index 30b4c288c1bb..c3fbbf4d3db7 100644 --- a/drivers/char/tpm/tpm-dev-common.c +++ b/drivers/char/tpm/tpm-dev-common.c @@ -47,6 +47,8 @@ static ssize_t tpm_dev_transmit(struct tpm_chip *chip, struct tpm_space *space, if (!ret) ret = tpm2_commit_space(chip, space, buf, &len); + else + tpm2_flush_space(chip); out_rc: return ret ? ret : len; diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c index 4892d491da8d..25a66870c165 100644 --- a/drivers/char/tpm/tpm2-space.c +++ b/drivers/char/tpm/tpm2-space.c @@ -169,6 +169,9 @@ void tpm2_flush_space(struct tpm_chip *chip) struct tpm_space *space = &chip->work_space; int i; + if (!space) + return; + for (i = 0; i < ARRAY_SIZE(space->context_tbl); i++) if (space->context_tbl[i] && ~space->context_tbl[i]) tpm2_flush_context(chip, space->context_tbl[i]);