tpm: fix crash in tpm_tis deinitialization

rmmod crashes the driver because tpm_chip_unregister() already sets ops
to NULL. This commit fixes the issue by moving tpm2_shutdown() to
tpm_chip_unregister(). This commit is also cleanup because it removes
duplicate code from tpm_crb and tpm_tis to the core.

Fixes: 4d3eac5e156a ("tpm: Provide strong locking for device removal")
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Reviewed-by: Jason Gunthorpe <jgunthorpe@obsidianresearch.com>

diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index f62c8518cd68f06ef59a7b6c7da6e326ebd32da8..5bc530ccbb868bacb45c290ac9b67d1bd4dbb717 100644 (file)
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -269,6 +269,7 @@ static void tpm_del_char_device(struct tpm_chip *chip)
 
        /* Make the driver uncallable. */
        down_write(&chip->ops_sem);
+       tpm2_shutdown(chip, TPM2_SU_CLEAR);
        chip->ops = NULL;
        up_write(&chip->ops_sem);
 }

diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c
index 5fc0e7c64daab08ffc6f060a2def26ce9e1ac534..e42266589ce65063ebc23703193502d6f3b0d6e0 100644 (file)
--- a/drivers/char/tpm/tpm2-cmd.c
+++ b/drivers/char/tpm/tpm2-cmd.c
@@ -773,7 +773,6 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type)
                dev_warn(&chip->dev, "transmit returned %d while stopping the TPM",
                         rc);
 }
-EXPORT_SYMBOL_GPL(tpm2_shutdown);
 
 /*
  * tpm2_calc_ordinal_duration() - maximum duration for a command

diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
index a12b3194034442ad4c5f87d9c6c6999d954edff5..ec734de87b76e1bdff5b65928c1e46022f194e02 100644 (file)
--- a/drivers/char/tpm/tpm_crb.c
+++ b/drivers/char/tpm/tpm_crb.c
@@ -344,9 +344,6 @@ static int crb_acpi_remove(struct acpi_device *device)
        struct device *dev = &device->dev;
        struct tpm_chip *chip = dev_get_drvdata(dev);
 
-       if (chip->flags & TPM_CHIP_FLAG_TPM2)
-               tpm2_shutdown(chip, TPM2_SU_CLEAR);
-
        tpm_chip_unregister(chip);
 
        return 0;

diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
index 18236f66c084d528dcffc81f8b0d3066efb6235d..0b0d44f9aaf23b2f2b28138be72cb89c78faa6c0 100644 (file)
--- a/drivers/char/tpm/tpm_tis.c
+++ b/drivers/char/tpm/tpm_tis.c
@@ -653,9 +653,6 @@ static void tpm_tis_remove(struct tpm_chip *chip)
        void __iomem *reg = chip->vendor.iobase +
                TPM_INT_ENABLE(chip->vendor.locality);
 
-       if (chip->flags & TPM_CHIP_FLAG_TPM2)
-               tpm2_shutdown(chip, TPM2_SU_CLEAR);
-
        iowrite32(~TPM_GLOBAL_INT_ENABLE & ioread32(reg), reg);
        release_locality(chip, chip->vendor.locality, 1);
 }