Rijo Thomas b3ef9e6fe0 tee: amdtee: fix race condition in amdtee_open_session ... commit f8502fba45 upstream. There is a potential race condition in amdtee_open_session that may lead to use-after-free. For instance, in amdtee_open_session() after sess->sess_mask is set, and before setting: sess->session_info[i] = session_info; if amdtee_close_session() closes this same session, then 'sess' data structure will be released, causing kernel panic when 'sess' is accessed within amdtee_open_session(). The solution is to set the bit sess->sess_mask as the last step in amdtee_open_session(). Fixes: 757cc3e9ff ("tee: add AMD-TEE driver") Cc: stable@vger.kernel.org Signed-off-by: Rijo Thomas <Rijo-john.Thomas@amd.com> Acked-by: Sumit Garg <sumit.garg@linaro.org> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-03-30 12:51:41 +02:00
..
amdtee_if.h
amdtee_private.h	tee: amdtee: unload TA only when its refcount becomes 0	2021-05-05 13:00:11 +02:00
call.c	tee: amdtee: Make use of the helper macro LIST_HEAD()	2022-02-14 10:57:55 +01:00
core.c	tee: amdtee: fix race condition in amdtee_open_session	2023-03-30 12:51:41 +02:00
Kconfig
Makefile
shm_pool.c	tee: simplify shm pool handling	2022-02-16 07:49:41 +01:00