Re: [BUG] tpm: prolonged stall in vtpm_proxy_fops_release() on Linux 7.3

[Stefan Berger]

> On 11/10/26 1:42 AM, 铮 wrote:
> > Hi Stefan,
> >
> > Thank you for your question about closing the server-side fd.
> >
> > Short answer: yes, the server-side fds are released when the
> > reproducer exits, and the hang occurs during that release. The hang
> > reproduced in 4/4 recorded exit-time release attempts (three with N=32
> > and one with N=4). However, our separate tests that explicitly call
> > close() on every ioctl-returned fd did NOT reproduce the hang.

Thanks, your supplied C-program made reproducing this issue 
straight-forward. A patch resolving this issue is attached.

   Stefan
From 6c4ee84a29d652c65714dc06f3cef674f6ac6127 Mon Sep 17 00:00:00 2001
From: Stefan Berger <stefanb@xxxxxxxxxxxxx>
Date: Tue, 10 Nov 2026 09:05:54 -0600
Subject: [PATCH] tpm: tpm_vtpm_proxy: Try to disable queued work before
 flushing it

If an application opens multiple server-side TPM file descriptors using the
ioctl() on /dev/tpmx and does not close them in the order they were opened,
then the closing of a file descriptor will run into flush_work() and be
blocked there behind other pending work and currently active work. As a
consequence, the currently active work, that is waiting for a response to
its TPM request, will have to wait for the command to time out since its
STATE_OPENED_FLAG will not be reset. To resolve this issue, try to disable
pending work first before flushing it. The disable_work() returns quickly
and unqueues work for most of the closing file descriptors. If it returns
false, then run flush_work(), which makes sure that ongoing work ends,
which also happens quickly since its STATE_OPENED_FLAG was cleared.

Fixes: 6f99612e2500 ("tpm: Proxy driver for supporting multiple emulated TPMs")
Signed-off-by: Stefan Berger <stefanb@xxxxxxxxxxxxx>
---
 drivers/char/tpm/tpm_vtpm_proxy.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/char/tpm/tpm_vtpm_proxy.c b/drivers/char/tpm/tpm_vtpm_proxy.c
index 245a8f959bc7..c539183acb03 100644
--- a/drivers/char/tpm/tpm_vtpm_proxy.c
+++ b/drivers/char/tpm/tpm_vtpm_proxy.c
@@ -465,7 +465,8 @@ static void vtpm_proxy_work(struct work_struct *work)
 static void vtpm_proxy_work_stop(struct proxy_dev *proxy_dev)
 {
 	vtpm_proxy_fops_undo_open(proxy_dev);
-	flush_work(&proxy_dev->work);
+	if (!disable_work(&proxy_dev->work))
+		flush_work(&proxy_dev->work);
 }
 
 /*
-- 
2.56.0