diff options
| author | Arnd Bergmann <arnd@arndb.de> | 2020-03-25 13:52:50 +0100 |
|---|---|---|
| committer | Arnd Bergmann <arnd@arndb.de> | 2020-03-25 14:27:27 +0100 |
| commit | 47039b55f8e2002baa7c00f35a7fd11361a8726c (patch) | |
| tree | 0cb2766ced2a93865ac61a88fbac0799e103b181 | |
| parent | a88fead83e0db632180a717930aff5fa2e401024 (diff) | |
| parent | 36fa3e50085e3858dd506e4431b9abd1bcb1f542 (diff) | |
Merge tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes
tee: amdtee: out of bounds read in find_session()
* tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee:
tee: amdtee: out of bounds read in find_session()
Link: https://lore.kernel.org/r/20200320063446.GA9892@jade
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
| -rw-r--r-- | drivers/tee/amdtee/core.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c index 0026eb6f13ce..27b4cd77d0db 100644 --- a/drivers/tee/amdtee/core.c +++ b/drivers/tee/amdtee/core.c @@ -139,6 +139,9 @@ static struct amdtee_session *find_session(struct amdtee_context_data *ctxdata, u32 index = get_session_index(session); struct amdtee_session *sess; + if (index >= TEE_NUM_SESSIONS) + return NULL; + list_for_each_entry(sess, &ctxdata->sess_list, list_node) if (ta_handle == sess->ta_handle && test_bit(index, sess->sess_mask)) |