summaryrefslogtreecommitdiff
path: root/drivers/tee
diff options
context:
space:
mode:
authorArnd Bergmann <arnd@arndb.de>2023-03-17 17:30:24 +0300
committerArnd Bergmann <arnd@arndb.de>2023-03-17 17:30:31 +0300
commit98dba5886b88d6d1f15cbe63e411409660dd568c (patch)
tree1ea43c6f50ad8f8027b45897a67f627391386bfc /drivers/tee
parentfe15c26ee26efa11741a7b632e9f23b01aca4cc6 (diff)
parentf8502fba45bd30e1a6a354d9d898bc99d1a11e6d (diff)
downloadlinux-98dba5886b88d6d1f15cbe63e411409660dd568c.tar.xz
Merge tag 'amdtee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee into soc-fixes
AMDTEE fix race condition in amdtee_open_session() * tag 'amdtee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: amdtee: fix race condition in amdtee_open_session Link: https://lore.kernel.org/r/Y/5ZGX0lSTnZz27E@rayden Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Diffstat (limited to 'drivers/tee')
-rw-r--r--drivers/tee/amdtee/core.c29
1 files changed, 14 insertions, 15 deletions
diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c
index 297dc62bca29..372d64756ed6 100644
--- a/drivers/tee/amdtee/core.c
+++ b/drivers/tee/amdtee/core.c
@@ -267,35 +267,34 @@ int amdtee_open_session(struct tee_context *ctx,
goto out;
}
+ /* Open session with loaded TA */
+ handle_open_session(arg, &session_info, param);
+ if (arg->ret != TEEC_SUCCESS) {
+ pr_err("open_session failed %d\n", arg->ret);
+ handle_unload_ta(ta_handle);
+ kref_put(&sess->refcount, destroy_session);
+ goto out;
+ }
+
/* Find an empty session index for the given TA */
spin_lock(&sess->lock);
i = find_first_zero_bit(sess->sess_mask, TEE_NUM_SESSIONS);
- if (i < TEE_NUM_SESSIONS)
+ if (i < TEE_NUM_SESSIONS) {
+ sess->session_info[i] = session_info;
+ set_session_id(ta_handle, i, &arg->session);
set_bit(i, sess->sess_mask);
+ }
spin_unlock(&sess->lock);
if (i >= TEE_NUM_SESSIONS) {
pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS);
+ handle_close_session(ta_handle, session_info);
handle_unload_ta(ta_handle);
kref_put(&sess->refcount, destroy_session);
rc = -ENOMEM;
goto out;
}
- /* Open session with loaded TA */
- handle_open_session(arg, &session_info, param);
- if (arg->ret != TEEC_SUCCESS) {
- pr_err("open_session failed %d\n", arg->ret);
- spin_lock(&sess->lock);
- clear_bit(i, sess->sess_mask);
- spin_unlock(&sess->lock);
- handle_unload_ta(ta_handle);
- kref_put(&sess->refcount, destroy_session);
- goto out;
- }
-
- sess->session_info[i] = session_info;
- set_session_id(ta_handle, i, &arg->session);
out:
free_pages((u64)ta, get_order(ta_size));
return rc;