diff options
| author | Arnd Bergmann <arnd@arndb.de> | 2023-03-17 17:30:24 +0300 |
|---|---|---|
| committer | Arnd Bergmann <arnd@arndb.de> | 2023-03-17 17:30:31 +0300 |
| commit | 98dba5886b88d6d1f15cbe63e411409660dd568c (patch) | |
| tree | 1ea43c6f50ad8f8027b45897a67f627391386bfc /drivers/tee | |
| parent | fe15c26ee26efa11741a7b632e9f23b01aca4cc6 (diff) | |
| parent | f8502fba45bd30e1a6a354d9d898bc99d1a11e6d (diff) | |
| download | linux-98dba5886b88d6d1f15cbe63e411409660dd568c.tar.xz | |
Merge tag 'amdtee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee into soc-fixes
AMDTEE fix race condition in amdtee_open_session()
* tag 'amdtee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee:
tee: amdtee: fix race condition in amdtee_open_session
Link: https://lore.kernel.org/r/Y/5ZGX0lSTnZz27E@rayden
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Diffstat (limited to 'drivers/tee')
| -rw-r--r-- | drivers/tee/amdtee/core.c | 29 |
1 files changed, 14 insertions, 15 deletions
diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c index 297dc62bca29..372d64756ed6 100644 --- a/drivers/tee/amdtee/core.c +++ b/drivers/tee/amdtee/core.c @@ -267,35 +267,34 @@ int amdtee_open_session(struct tee_context *ctx, goto out; } + /* Open session with loaded TA */ + handle_open_session(arg, &session_info, param); + if (arg->ret != TEEC_SUCCESS) { + pr_err("open_session failed %d\n", arg->ret); + handle_unload_ta(ta_handle); + kref_put(&sess->refcount, destroy_session); + goto out; + } + /* Find an empty session index for the given TA */ spin_lock(&sess->lock); i = find_first_zero_bit(sess->sess_mask, TEE_NUM_SESSIONS); - if (i < TEE_NUM_SESSIONS) + if (i < TEE_NUM_SESSIONS) { + sess->session_info[i] = session_info; + set_session_id(ta_handle, i, &arg->session); set_bit(i, sess->sess_mask); + } spin_unlock(&sess->lock); if (i >= TEE_NUM_SESSIONS) { pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS); + handle_close_session(ta_handle, session_info); handle_unload_ta(ta_handle); kref_put(&sess->refcount, destroy_session); rc = -ENOMEM; goto out; } - /* Open session with loaded TA */ - handle_open_session(arg, &session_info, param); - if (arg->ret != TEEC_SUCCESS) { - pr_err("open_session failed %d\n", arg->ret); - spin_lock(&sess->lock); - clear_bit(i, sess->sess_mask); - spin_unlock(&sess->lock); - handle_unload_ta(ta_handle); - kref_put(&sess->refcount, destroy_session); - goto out; - } - - sess->session_info[i] = session_info; - set_session_id(ta_handle, i, &arg->session); out: free_pages((u64)ta, get_order(ta_size)); return rc; |