Commit 47039b55 authored Mar 25, 2020 by Arnd Bergmann

Merge tag 'tee-amdtee-fix2-for-5.6' of...

Merge tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes

tee: amdtee: out of bounds read in find_session()

* tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee:
  tee: amdtee: out of bounds read in find_session()

Link: https://lore.kernel.org/r/20200320063446.GA9892@jade


Signed-off-by: Arnd Bergmann <arnd@arndb.de>

parents a88fead8 36fa3e50

drivers/tee/amdtee/core.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -139,6 +139,9 @@ static struct amdtee_session find_session(struct amdtee_context_data ctxdata,
		u32 index = get_session_index(session);
		struct amdtee_session *sess;

		if (index >= TEE_NUM_SESSIONS)
		return NULL;

		list_for_each_entry(sess, &ctxdata->sess_list, list_node)
		if (ta_handle == sess->ta_handle &&
		test_bit(index, sess->sess_mask))

Admin message