kernel/linux.git/drivers/tee/amdtee/core.c, branch v5.6.17

Merge tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes

2020-03-25T13:27:27+00:00

tee: amdtee: out of bounds read in find_session() * tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: amdtee: out of bounds read in find_session() Link: https://lore.kernel.org/r/20200320063446.GA9892@jade Signed-off-by: Arnd Bergmann

tee: amdtee: out of bounds read in find_session()

2020-03-10T07:12:04+00:00

The "index" is a user provided value from 0-USHRT_MAX. If it's over TEE_NUM_SESSIONS (31) then it results in an out of bounds read when we call test_bit(index, sess->sess_mask). Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Acked-by: Rijo Thomas Signed-off-by: Dan Carpenter Signed-off-by: Jens Wiklander

tee: amdtee: fix memory leak in amdtee_open_session()

2020-02-27T15:22:05+00:00

On these error paths the "sess" variable isn't freed. It's a refcounted pointer so we need to call kref_put(). I re-arranged the code a bit so the error case is always handled before the success case and the error paths are indented two tabs. Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Reviewed-by: Rijo Thomas Signed-off-by: Dan Carpenter Signed-off-by: Jens Wiklander

tee: fix memory allocation failure checks on drv_data and amdtee

2020-01-22T08:21:11+00:00

Currently the memory allocation failure checks on drv_data and amdtee are using IS_ERR rather than checking for a null pointer. Fix these checks to use the conventional null pointer check. Addresses-Coverity: ("Dereference null return") Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Signed-off-by: Colin Ian King Reviewed-by: Rijo Thomas Acked-by: Jens Wiklander Signed-off-by: Herbert Xu

tee: amdtee: remove redundant NULL check for pool

2020-01-16T07:18:14+00:00

Remove NULL check for pool variable, since in the current code path it is guaranteed to be non-NULL. Reported-by: Dan Carpenter Signed-off-by: Rijo Thomas Signed-off-by: Herbert Xu

tee: amdtee: rename err label to err_device_unregister

2020-01-16T07:18:13+00:00

Rename err label to err_device_unregister for better readability. Suggested-by: Dan Carpenter Signed-off-by: Rijo Thomas Signed-off-by: Herbert Xu

tee: amdtee: skip tee_device_unregister if tee_device_alloc fails

2020-01-16T07:18:13+00:00

Currently, if tee_device_alloc() fails, then tee_device_unregister() is a no-op. Therefore, skip the function call to tee_device_unregister() by introducing a new goto label 'err_free_pool'. Reported-by: Dan Carpenter Signed-off-by: Rijo Thomas Signed-off-by: Herbert Xu

tee: amdtee: print error message if tee not present

2020-01-16T07:18:13+00:00

If there is no TEE with which the driver can communicate, then print an error message and return. Suggested-by: Dan Carpenter Signed-off-by: Rijo Thomas Signed-off-by: Herbert Xu

tee: amdtee: remove unused variable initialization

2020-01-16T07:18:13+00:00

Remove unused variable initialization from driver code. If enabled as a compiler option, compiler may throw warning for unused assignments. Reported-by: Dan Carpenter Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Signed-off-by: Rijo Thomas Signed-off-by: Herbert Xu

tee: amdtee: check TEE status during driver initialization

2020-01-04T05:49:51+00:00

The AMD-TEE driver should check if TEE is available before registering itself with TEE subsystem. This ensures that there is a TEE which the driver can talk to before proceeding with tee device node allocation. Cc: Ard Biesheuvel Cc: Tom Lendacky Acked-by: Jens Wiklander Co-developed-by: Devaraj Rangasamy Signed-off-by: Devaraj Rangasamy Signed-off-by: Rijo Thomas Reviewed-by: Gary R Hook Signed-off-by: Herbert Xu