On Tue, Mar 07, 2017 at 11:12:43PM -0500, Hon Ching(Vicky) Lo wrote: > On Mon, 2017-03-06 at 16:19 -0700, Jason Gunthorpe wrote:
> > Also, how does locking work here? Does the vio core prevent > > tpm_ibmvtpm_get_desired_dma and tpm_ibmvtpm_remove from running > > concurrently? > > No, vio core doesn't prevent tpm_ibmvtpm_get_desired_dma and > tpm_ibmvtpm_remove > from running concurrently. > > vio_bus_probe calls vio_cmo_bus_probe which calls tpm_ibmvtpm_get_desired_dma. > tpm_ibmvtpm_get_desired_dma is called before the code enters critical section. > > There is no locking mechanism around tpm_ibmvtpm_remove in vio_bus_remove. > > What's the concern here? tpm_ibmvtpm_remove makes the pointer that tpm_ibmvtpm_get_desired_dma is accessing invalid, so some kind of locking is technically required so that the two things do not create a use after free race: > > + /* For tpm_ibmvtpm_get_desired_dma */ > > + dev_set_drvdata(&vdev->dev, NULL); > > kfree(ibmvtpm); Eg with the kfree above. It may be that the driver core prevents probe/remove from running concurrently and things are fine, but this is something to confirm.. Jason ------------------------------------------------------------------------------ Announcing the Oxford Dictionaries API! The API offers world-renowned dictionary content that is easy and intuitive to access. Sign up for an account today to start using our lexical data to power your apps and projects. Get started today and enter our developer competition. http://sdm.link/oxford _______________________________________________ tpmdd-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tpmdd-devel
