| commit | 47039b55f8e2002baa7c00f35a7fd11361a8726c | [log] [tgz] |
|---|---|---|
| author | Arnd Bergmann <arnd@arndb.de> | Wed Mar 25 13:52:50 2020 +0100 |
| committer | Arnd Bergmann <arnd@arndb.de> | Wed Mar 25 14:27:27 2020 +0100 |
| tree | 0cb2766ced2a93865ac61a88fbac0799e103b181 | |
| parent | a88fead83e0db632180a717930aff5fa2e401024 [diff] | |
| parent | 36fa3e50085e3858dd506e4431b9abd1bcb1f542 [diff] |
Merge tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee into arm/fixes tee: amdtee: out of bounds read in find_session() * tag 'tee-amdtee-fix2-for-5.6' of https://git.linaro.org/people/jens.wiklander/linux-tee: tee: amdtee: out of bounds read in find_session() Link: https://lore.kernel.org/r/20200320063446.GA9892@jade Signed-off-by: Arnd Bergmann <arnd@arndb.de>
diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c index 0026eb6..27b4cd7 100644 --- a/drivers/tee/amdtee/core.c +++ b/drivers/tee/amdtee/core.c
@@ -139,6 +139,9 @@ u32 index = get_session_index(session); struct amdtee_session *sess; + if (index >= TEE_NUM_SESSIONS) + return NULL; + list_for_each_entry(sess, &ctxdata->sess_list, list_node) if (ta_handle == sess->ta_handle && test_bit(index, sess->sess_mask))