linux-kernel - [PATCH v3 7/7] firmware: tee_bnxt: Release shm, session, and context during kexec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Tue,  8 Jun 2021 19:23:26 -0500
From:   Tyler Hicks <tyhicks@...ux.microsoft.com>
To:     Jens Wiklander <jens.wiklander@...aro.org>,
        Allen Pais <apais@...ux.microsoft.com>,
        Sumit Garg <sumit.garg@...aro.org>,
        Peter Huewe <peterhuewe@....de>,
        Jarkko Sakkinen <jarkko@...nel.org>,
        Jason Gunthorpe <jgg@...pe.ca>,
        Vikas Gupta <vikas.gupta@...adcom.com>
Cc:     Thirupathaiah Annapureddy <thiruan@...rosoft.com>,
        Pavel Tatashin <pasha.tatashin@...een.com>,
        Rafał Miłecki <zajec5@...il.com>,
        op-tee@...ts.trustedfirmware.org, linux-integrity@...r.kernel.org,
        bcm-kernel-feedback-list@...adcom.com, linux-mips@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH v3 7/7] firmware: tee_bnxt: Release shm, session, and context during kexec

From: Allen Pais <apais@...ux.microsoft.com>

Implement a .shutdown hook that will be called during a kexec operation
so that the TEE shared memory, session, and context that were set up
during .probe can be properly freed/closed.

Additionally, don't use dma-buf backed shared memory for the multi-page
dynamic shm that's private to the driver. dma-buf backed shared memory
cannot be reliably freed and unregistered during a kexec operation even
when tee_shm_free() is called on the shm from a .shutdown hook. The
problem occurs because dma_buf_put() calls fput() which then uses
task_work_add(), with the TWA_RESUME parameter, to queue
tee_shm_release() to be called before the current task returns to user
mode. However, the current task never returns to user mode before the
kexec completes so the memory is never freed nor unregistered.

Continue to register the multi-page dynamic shm with the TEE so that all
4K chunks can be used.

Fixes: 246880958ac9 ("firmware: broadcom: add OP-TEE based BNXT f/w manager")
Signed-off-by: Allen Pais <apais@...ux.microsoft.com>
Co-developed-by: Tyler Hicks <tyhicks@...ux.microsoft.com>
Signed-off-by: Tyler Hicks <tyhicks@...ux.microsoft.com>
---
 drivers/firmware/broadcom/tee_bnxt_fw.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/drivers/firmware/broadcom/tee_bnxt_fw.c b/drivers/firmware/broadcom/tee_bnxt_fw.c
index ed10da5313e8..c496723e9e8d 100644
--- a/drivers/firmware/broadcom/tee_bnxt_fw.c
+++ b/drivers/firmware/broadcom/tee_bnxt_fw.c
@@ -213,7 +213,7 @@ static int tee_bnxt_fw_probe(struct device *dev)
 	pvt_data.dev = dev;
 
 	fw_shm_pool = tee_shm_alloc(pvt_data.ctx, MAX_SHM_MEM_SZ,
-				    TEE_SHM_MAPPED | TEE_SHM_DMA_BUF);
+				    TEE_SHM_MAPPED | TEE_SHM_REGISTER);
 	if (IS_ERR(fw_shm_pool)) {
 		dev_err(pvt_data.dev, "tee_shm_alloc failed\n");
 		err = PTR_ERR(fw_shm_pool);
@@ -242,6 +242,14 @@ static int tee_bnxt_fw_remove(struct device *dev)
 	return 0;
 }
 
+static void tee_bnxt_fw_shutdown(struct device *dev)
+{
+	tee_shm_free(pvt_data.fw_shm_pool);
+	tee_client_close_session(pvt_data.ctx, pvt_data.session_id);
+	tee_client_close_context(pvt_data.ctx);
+	pvt_data.ctx = NULL;
+}
+
 static const struct tee_client_device_id tee_bnxt_fw_id_table[] = {
 	{UUID_INIT(0x6272636D, 0x2019, 0x0716,
 		    0x42, 0x43, 0x4D, 0x5F, 0x53, 0x43, 0x48, 0x49)},
@@ -257,6 +265,7 @@ static struct tee_client_driver tee_bnxt_fw_driver = {
 		.bus		= &tee_bus_type,
 		.probe		= tee_bnxt_fw_probe,
 		.remove		= tee_bnxt_fw_remove,
+		.shutdown	= tee_bnxt_fw_shutdown,
 	},
 };
 
-- 
2.25.1