Commit 98dba588 authored by Arnd Bergmann's avatar Arnd Bergmann

Merge tag 'amdtee-fix-for-v6.3' of...

Merge tag 'amdtee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee into soc-fixes

AMDTEE fix race condition in amdtee_open_session()

* tag 'amdtee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee:
  tee: amdtee: fix race condition in amdtee_open_session

Link: https://lore.kernel.org/r/Y/5ZGX0lSTnZz27E@raydenSigned-off-by: default avatarArnd Bergmann <arnd@arndb.de>
parents fe15c26e f8502fba
...@@ -267,35 +267,34 @@ int amdtee_open_session(struct tee_context *ctx, ...@@ -267,35 +267,34 @@ int amdtee_open_session(struct tee_context *ctx,
goto out; goto out;
} }
/* Open session with loaded TA */
handle_open_session(arg, &session_info, param);
if (arg->ret != TEEC_SUCCESS) {
pr_err("open_session failed %d\n", arg->ret);
handle_unload_ta(ta_handle);
kref_put(&sess->refcount, destroy_session);
goto out;
}
/* Find an empty session index for the given TA */ /* Find an empty session index for the given TA */
spin_lock(&sess->lock); spin_lock(&sess->lock);
i = find_first_zero_bit(sess->sess_mask, TEE_NUM_SESSIONS); i = find_first_zero_bit(sess->sess_mask, TEE_NUM_SESSIONS);
if (i < TEE_NUM_SESSIONS) if (i < TEE_NUM_SESSIONS) {
sess->session_info[i] = session_info;
set_session_id(ta_handle, i, &arg->session);
set_bit(i, sess->sess_mask); set_bit(i, sess->sess_mask);
}
spin_unlock(&sess->lock); spin_unlock(&sess->lock);
if (i >= TEE_NUM_SESSIONS) { if (i >= TEE_NUM_SESSIONS) {
pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS); pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS);
handle_close_session(ta_handle, session_info);
handle_unload_ta(ta_handle); handle_unload_ta(ta_handle);
kref_put(&sess->refcount, destroy_session); kref_put(&sess->refcount, destroy_session);
rc = -ENOMEM; rc = -ENOMEM;
goto out; goto out;
} }
/* Open session with loaded TA */
handle_open_session(arg, &session_info, param);
if (arg->ret != TEEC_SUCCESS) {
pr_err("open_session failed %d\n", arg->ret);
spin_lock(&sess->lock);
clear_bit(i, sess->sess_mask);
spin_unlock(&sess->lock);
handle_unload_ta(ta_handle);
kref_put(&sess->refcount, destroy_session);
goto out;
}
sess->session_info[i] = session_info;
set_session_id(ta_handle, i, &arg->session);
out: out:
free_pages((u64)ta, get_order(ta_size)); free_pages((u64)ta, get_order(ta_size));
return rc; return rc;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment