linux-kernel - [PATCH v3 6/7] tpm_ftpm_tee: Free and unregister dynamic shared memory during kexec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210609002326.210024-7-tyhicks@linux.microsoft.com>
Date:   Tue,  8 Jun 2021 19:23:25 -0500
From:   Tyler Hicks <tyhicks@...ux.microsoft.com>
To:     Jens Wiklander <jens.wiklander@...aro.org>,
        Allen Pais <apais@...ux.microsoft.com>,
        Sumit Garg <sumit.garg@...aro.org>,
        Peter Huewe <peterhuewe@....de>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        Jason Gunthorpe <jgg@...pe.ca>,
        Vikas Gupta <vikas.gupta@...adcom.com>
Cc:     Thirupathaiah Annapureddy <thiruan@...rosoft.com>,
        Pavel Tatashin <pasha.tatashin@...een.com>,
        Rafał Miłecki <zajec5@...il.com>,
        op-tee@...ts.trustedfirmware.org, linux-integrity@...r.kernel.org,
        bcm-kernel-feedback-list@...adcom.com, linux-mips@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH v3 6/7] tpm_ftpm_tee: Free and unregister dynamic shared memory during kexec

dma-buf backed shared memory cannot be reliably freed and unregistered
during a kexec operation even when tee_shm_free() is called on the shm
from a .shutdown hook. The problem occurs because dma_buf_put() calls
fput() which then uses task_work_add(), with the TWA_RESUME parameter,
to queue tee_shm_release() to be called before the current task returns
to user mode. However, the current task never returns to user mode
before the kexec completes so the memory is never freed nor
unregistered.

Don't use dma-buf backed shared memory for a multi-page dynamic shm
that's private to the driver. Not using a dma-buf backed shm will allow
tee_shm_free() to directly call tee_shm_release() so that the shared
memory can be freed and unregistered during a kexec operation.

Continue to register the multi-page dynamic shm with the TEE so that all
4K chunks can be used.

Fixes: 09e574831b27 ("tpm/tpm_ftpm_tee: A driver for firmware TPM running inside TEE")
Fixes: 1760eb689ed6 ("tpm/tpm_ftpm_tee: add shutdown call back")
Signed-off-by: Tyler Hicks <tyhicks@...ux.microsoft.com>
---
 drivers/char/tpm/tpm_ftpm_tee.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/char/tpm/tpm_ftpm_tee.c b/drivers/char/tpm/tpm_ftpm_tee.c
index 2ccdf8ac6994..8f1155227506 100644
--- a/drivers/char/tpm/tpm_ftpm_tee.c
+++ b/drivers/char/tpm/tpm_ftpm_tee.c
@@ -256,7 +256,7 @@ static int ftpm_tee_probe(struct device *dev)
 	/* Allocate dynamic shared memory with fTPM TA */
 	pvt_data->shm = tee_shm_alloc(pvt_data->ctx,
 				      MAX_COMMAND_SIZE + MAX_RESPONSE_SIZE,
-				      TEE_SHM_MAPPED | TEE_SHM_DMA_BUF);
+				      TEE_SHM_MAPPED | TEE_SHM_REGISTER);
 	if (IS_ERR(pvt_data->shm)) {
 		dev_err(dev, "%s: tee_shm_alloc failed\n", __func__);
 		rc = -ENOMEM;
-- 
2.25.1