summaryrefslogtreecommitdiff
path: root/drivers/tee
diff options
context:
space:
mode:
authorArnd Bergmann <arnd@arndb.de>2020-03-25 13:52:50 +0100
committerArnd Bergmann <arnd@arndb.de>2020-03-25 14:27:27 +0100
commit47039b55f8e2002baa7c00f35a7fd11361a8726c (patch)
tree0cb2766ced2a93865ac61a88fbac0799e103b181 /drivers/tee
parenta88fead83e0db632180a717930aff5fa2e401024 (diff)
parent36fa3e50085e3858dd506e4431b9abd1bcb1f542 (diff)
Merge tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes
tee: amdtee: out of bounds read in find_session() * tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: amdtee: out of bounds read in find_session() Link: https://lore.kernel.org/r/20200320063446.GA9892@jade Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Diffstat (limited to 'drivers/tee')
-rw-r--r--drivers/tee/amdtee/core.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c
index 0026eb6f13ce..27b4cd77d0db 100644
--- a/drivers/tee/amdtee/core.c
+++ b/drivers/tee/amdtee/core.c
@@ -139,6 +139,9 @@ static struct amdtee_session *find_session(struct amdtee_context_data *ctxdata,
u32 index = get_session_index(session);
struct amdtee_session *sess;
+ if (index >= TEE_NUM_SESSIONS)
+ return NULL;
+
list_for_each_entry(sess, &ctxdata->sess_list, list_node)
if (ta_handle == sess->ta_handle &&
test_bit(index, sess->sess_mask))