Re: [BUG] tpm: prolonged stall in vtpm_proxy_fops_release() on Linux 7.3

[Stefan Berger <stefanb@linux.ibm.com>]

[-- Attachment #1: Type: text/plain, Size: 606 bytes --]


> 
> On 11/10/26 1:42 AM, 铮 wrote:
>> Hi Stefan,
>>
>> Thank you for your question about closing the server-side fd.
>>
>> Short answer: yes, the server-side fds are released when the
>> reproducer exits, and the hang occurs during that release. The hang
>> reproduced in 4/4 recorded exit-time release attempts (three with N=32
>> and one with N=4). However, our separate tests that explicitly call
>> close() on every ioctl-returned fd did NOT reproduce the hang.
> 

Thanks, your supplied C-program made reproducing this issue 
straight-forward. A patch resolving this issue is attached.

    Stefan

[-- Attachment #2: 0001-tpm-tpm_vtpm_proxy-Try-to-disable-queued-work-before.patch --]
[-- Type: text/x-patch, Size: 1782 bytes --]

From 6c4ee84a29d652c65714dc06f3cef674f6ac6127 Mon Sep 17 00:00:00 2001
From: Stefan Berger <stefanb@linux.ibm.com>
Date: Tue, 10 Nov 2026 09:05:54 -0600
Subject: [PATCH] tpm: tpm_vtpm_proxy: Try to disable queued work before
 flushing it

If an application opens multiple server-side TPM file descriptors using the
ioctl() on /dev/tpmx and does not close them in the order they were opened,
then the closing of a file descriptor will run into flush_work() and be
blocked there behind other pending work and currently active work. As a
consequence, the currently active work, that is waiting for a response to
its TPM request, will have to wait for the command to time out since its
STATE_OPENED_FLAG will not be reset. To resolve this issue, try to disable
pending work first before flushing it. The disable_work() returns quickly
and unqueues work for most of the closing file descriptors. If it returns
false, then run flush_work(), which makes sure that ongoing work ends,
which also happens quickly since its STATE_OPENED_FLAG was cleared.

Fixes: 6f99612e2500 ("tpm: Proxy driver for supporting multiple emulated TPMs")
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
 drivers/char/tpm/tpm_vtpm_proxy.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/char/tpm/tpm_vtpm_proxy.c b/drivers/char/tpm/tpm_vtpm_proxy.c
index 245a8f959bc7..c539183acb03 100644
--- a/drivers/char/tpm/tpm_vtpm_proxy.c
+++ b/drivers/char/tpm/tpm_vtpm_proxy.c
@@ -465,7 +465,8 @@ static void vtpm_proxy_work(struct work_struct *work)
 static void vtpm_proxy_work_stop(struct proxy_dev *proxy_dev)
 {
 	vtpm_proxy_fops_undo_open(proxy_dev);
-	flush_work(&proxy_dev->work);
+	if (!disable_work(&proxy_dev->work))
+		flush_work(&proxy_dev->work);
 }
 
 /*
-- 
2.56.0