tpm: fix crash in tpm_tis deinitialization

Jarkko Sakkinen · Jarkko Sakkinen · commit 20e0152393b4 · 2016-04-14T13:14:34.000+03:00
rmmod crashes the driver because tpm_chip_unregister() already sets ops to NULL. This commit fixes the issue by moving tpm2_shutdown() to tpm_chip_unregister(). This commit is also cleanup because it removes duplicate code from tpm_crb and tpm_tis to the core. Fixes: 4d3eac5 ("tpm: Provide strong locking for device removal") Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com> Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>
diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
@@ -269,6 +269,7 @@ static void tpm_del_char_device(struct tpm_chip *chip)
 
 	/* Make the driver uncallable. */
 	down_write(&chip->ops_sem);
+	tpm2_shutdown(chip, TPM2_SU_CLEAR);
 	chip->ops = NULL;
 	up_write(&chip->ops_sem);
 }
diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
@@ -773,7 +773,6 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
 		dev_warn(&chip->dev, "transmit returned %d while stopping the TPM",
 			 rc);
 }
-EXPORT_SYMBOL_GPL(tpm2_shutdown);
 
 /*
  * tpm2_calc_ordinal_duration() - maximum duration for a command
diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
@@ -344,9 +344,6 @@ static int crb_acpi_remove(struct acpi_device *device)
 	struct device *dev = &device->dev;
 	struct tpm_chip *chip = dev_get_drvdata(dev);
 
-	if (chip->flags & TPM_CHIP_FLAG_TPM2)
-		tpm2_shutdown(chip, TPM2_SU_CLEAR);
-
 	tpm_chip_unregister(chip);
 
 	return 0;
diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
@@ -653,9 +653,6 @@ static void tpm_tis_remove(struct tpm_chip *chip)
 	void __iomem *reg = chip->vendor.iobase +
 		TPM_INT_ENABLE(chip->vendor.locality);
 
-	if (chip->flags & TPM_CHIP_FLAG_TPM2)
-		tpm2_shutdown(chip, TPM2_SU_CLEAR);
-
 	iowrite32(~TPM_GLOBAL_INT_ENABLE & ioread32(reg), reg);
 	release_locality(chip, chip->vendor.locality, 1);
 }

Original file line number	Diff line number	Diff line change
`@@ -269,6 +269,7 @@ static void tpm_del_char_device(struct tpm_chip *chip)`
`269`	`269`
`270`	`270`	`/* Make the driver uncallable. */`
`271`	`271`	`down_write(&chip->ops_sem);`
	`272`	`+ tpm2_shutdown(chip, TPM2_SU_CLEAR);`
`272`	`273`	`chip->ops = NULL;`
`273`	`274`	`up_write(&chip->ops_sem);`
`274`	`275`	`}`
Original file line number	Diff line number	Diff line change
`@@ -773,7 +773,6 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)`
`773`	`773`	`dev_warn(&chip->dev, "transmit returned %d while stopping the TPM",`
`774`	`774`	`rc);`
`775`	`775`	`}`
`776`		`-EXPORT_SYMBOL_GPL(tpm2_shutdown);`
`777`	`776`
`778`	`777`	`/*`
`779`	`778`	`* tpm2_calc_ordinal_duration() - maximum duration for a command`
Original file line number	Diff line number	Diff line change
`@@ -653,9 +653,6 @@ static void tpm_tis_remove(struct tpm_chip *chip)`
`653`	`653`	`void __iomem *reg = chip->vendor.iobase +`
`654`	`654`	`TPM_INT_ENABLE(chip->vendor.locality);`
`655`	`655`
`656`		`- if (chip->flags & TPM_CHIP_FLAG_TPM2)`
`657`		`- tpm2_shutdown(chip, TPM2_SU_CLEAR);`
`658`		`-`
`659`	`656`	`iowrite32(~TPM_GLOBAL_INT_ENABLE & ioread32(reg), reg);`
`660`	`657`	`release_locality(chip, chip->vendor.locality, 1);`
`661`	`658`	`}`