[PATCH] tpm: fix potential NULL pointer access in tpm_del_char_device()

[Lino Sanfilippo]

In tpm_del_char_device() make sure that chip->ops is still valid.
This check is needed since in case of a system shutdown
tpm_class_shutdown() has already been called and set chip->ops to NULL.
This leads to a NULL pointer access as soon as tpm_del_char_device()
tries to access chip->ops in case of TPM 2.

Fixes: dcbeab1946454 ("tpm: fix crash in tpm_tis deinitialization")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Lino Sanfilippo <LinoSanfilippo@xxxxxx>
---
 drivers/char/tpm/tpm-chip.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
index ddaeceb7e109..ed1fb5d82caf 100644
--- a/drivers/char/tpm/tpm-chip.c
+++ b/drivers/char/tpm/tpm-chip.c
@@ -474,13 +474,19 @@ static void tpm_del_char_device(struct tpm_chip *chip)
 
 	/* Make the driver uncallable. */
 	down_write(&chip->ops_sem);
-	if (chip->flags & TPM_CHIP_FLAG_TPM2) {
-		if (!tpm_chip_start(chip)) {
-			tpm2_shutdown(chip, TPM2_SU_CLEAR);
-			tpm_chip_stop(chip);
+	/* Check if chip->ops is still valid since in case of a shutdown
+	 * tpm_class_shutdown() has already sent the TPM2_Shutdown command
+	 * and set chip->ops to NULL.
+	 */
+	if (chip->ops) {
+		if (chip->flags & TPM_CHIP_FLAG_TPM2) {
+			if (!tpm_chip_start(chip)) {
+				tpm2_shutdown(chip, TPM2_SU_CLEAR);
+				tpm_chip_stop(chip);
+			}
 		}
+		chip->ops = NULL;
 	}
-	chip->ops = NULL;
 	up_write(&chip->ops_sem);
 }
 

base-commit: a3fa7a101dcff93791d1b1bdb3affcad1410c8c1
-- 
2.33.0