kernel/linux.git/drivers/tee/amdtee/core.c, branch v5.15.7

tee: amdtee: unload TA only when its refcount becomes 0

2021-05-05T11:00:11+00:00

Same Trusted Application (TA) can be loaded in multiple TEE contexts. If it is a single instance TA, the TA should not get unloaded from AMD Secure Processor, while it is still in use in another TEE context. Therefore reference count TA and unload it when the count becomes zero. Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Reviewed-by: Devaraj Rangasamy Signed-off-by: Rijo Thomas Acked-by: Dan Carpenter Signed-off-by: Jens Wiklander

tee: amdtee: synchronize access to shm list

2020-11-09T07:59:00+00:00

Synchronize access to shm or shared memory buffer list to prevent race conditions due to concurrent updates to shared shm list by multiple threads. Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Reviewed-by: Devaraj Rangasamy Signed-off-by: Rijo Thomas Signed-off-by: Jens Wiklander

tee: amdtee: fix memory leak due to reset of global shm list

2020-11-09T07:58:54+00:00

The driver maintains a list of shared memory buffers along with their mapped buffer id's in a global linked list. These buffers need to be unmapped after use by the user-space client. The global shared memory list is initialized to zero entries in the function amdtee_open(). This clearing of list entries can be a source for memory leak on secure side if the global linked list previously held some mapped buffer entries allocated from another TEE context. Fix potential memory leak issue by moving global shared memory list to AMD-TEE driver context data structure. Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Reviewed-by: Devaraj Rangasamy Signed-off-by: Rijo Thomas Signed-off-by: Jens Wiklander

Merge tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes

2020-03-25T13:27:27+00:00

tee: amdtee: out of bounds read in find_session() * tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: amdtee: out of bounds read in find_session() Link: https://lore.kernel.org/r/20200320063446.GA9892@jade Signed-off-by: Arnd Bergmann

tee: amdtee: out of bounds read in find_session()

2020-03-10T07:12:04+00:00

The "index" is a user provided value from 0-USHRT_MAX. If it's over TEE_NUM_SESSIONS (31) then it results in an out of bounds read when we call test_bit(index, sess->sess_mask). Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Acked-by: Rijo Thomas Signed-off-by: Dan Carpenter Signed-off-by: Jens Wiklander

tee: amdtee: fix memory leak in amdtee_open_session()

2020-02-27T15:22:05+00:00

On these error paths the "sess" variable isn't freed. It's a refcounted pointer so we need to call kref_put(). I re-arranged the code a bit so the error case is always handled before the success case and the error paths are indented two tabs. Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Reviewed-by: Rijo Thomas Signed-off-by: Dan Carpenter Signed-off-by: Jens Wiklander

tee: fix memory allocation failure checks on drv_data and amdtee

2020-01-22T08:21:11+00:00

Currently the memory allocation failure checks on drv_data and amdtee are using IS_ERR rather than checking for a null pointer. Fix these checks to use the conventional null pointer check. Addresses-Coverity: ("Dereference null return") Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Signed-off-by: Colin Ian King Reviewed-by: Rijo Thomas Acked-by: Jens Wiklander Signed-off-by: Herbert Xu

tee: amdtee: remove redundant NULL check for pool

2020-01-16T07:18:14+00:00

Remove NULL check for pool variable, since in the current code path it is guaranteed to be non-NULL. Reported-by: Dan Carpenter Signed-off-by: Rijo Thomas Signed-off-by: Herbert Xu

tee: amdtee: rename err label to err_device_unregister

2020-01-16T07:18:13+00:00

Rename err label to err_device_unregister for better readability. Suggested-by: Dan Carpenter Signed-off-by: Rijo Thomas Signed-off-by: Herbert Xu

tee: amdtee: skip tee_device_unregister if tee_device_alloc fails

2020-01-16T07:18:13+00:00

Currently, if tee_device_alloc() fails, then tee_device_unregister() is a no-op. Therefore, skip the function call to tee_device_unregister() by introducing a new goto label 'err_free_pool'. Reported-by: Dan Carpenter Signed-off-by: Rijo Thomas Signed-off-by: Herbert Xu