This is a note to let you know that I've just added the patch titled tee: amdtee: synchronize access to shm list to the 5.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tee-amdtee-synchronize-access-to-shm-list.patch and it can be found in the queue-5.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. commit e8b774f799bca211256bf0f34a76e0ca7014ba6e Author: Rijo Thomas <Rijo-john.Thomas@xxxxxxx> Date: Wed Nov 4 11:56:10 2020 +0530 tee: amdtee: synchronize access to shm list [ Upstream commit be353be27874f40837327d9a39e3ad2149ab66d3 ] Synchronize access to shm or shared memory buffer list to prevent race conditions due to concurrent updates to shared shm list by multiple threads. Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver") Reviewed-by: Devaraj Rangasamy <Devaraj.Rangasamy@xxxxxxx> Signed-off-by: Rijo Thomas <Rijo-john.Thomas@xxxxxxx> Signed-off-by: Jens Wiklander <jens.wiklander@xxxxxxxxxx> Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx> diff --git a/drivers/tee/amdtee/amdtee_private.h b/drivers/tee/amdtee/amdtee_private.h index 97df16a17285a..337c8d82f74eb 100644 --- a/drivers/tee/amdtee/amdtee_private.h +++ b/drivers/tee/amdtee/amdtee_private.h @@ -70,6 +70,7 @@ struct amdtee_session { struct amdtee_context_data { struct list_head sess_list; struct list_head shm_list; + struct mutex shm_mutex; /* synchronizes access to @shm_list */ }; struct amdtee_driver_data { diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c index ce61c68ec58cb..8a6a8f30bb427 100644 --- a/drivers/tee/amdtee/core.c +++ b/drivers/tee/amdtee/core.c @@ -42,6 +42,7 @@ static int amdtee_open(struct tee_context *ctx) INIT_LIST_HEAD(&ctxdata->sess_list); INIT_LIST_HEAD(&ctxdata->shm_list); + mutex_init(&ctxdata->shm_mutex); ctx->data = ctxdata; return 0; @@ -85,6 +86,7 @@ static void amdtee_release(struct tee_context *ctx) list_del(&sess->list_node); release_session(sess); } + mutex_destroy(&ctxdata->shm_mutex); kfree(ctxdata); ctx->data = NULL; @@ -155,11 +157,13 @@ u32 get_buffer_id(struct tee_shm *shm) struct amdtee_shm_data *shmdata; u32 buf_id = 0; + mutex_lock(&ctxdata->shm_mutex); list_for_each_entry(shmdata, &ctxdata->shm_list, shm_node) if (shmdata->kaddr == shm->kaddr) { buf_id = shmdata->buf_id; break; } + mutex_unlock(&ctxdata->shm_mutex); return buf_id; } @@ -364,7 +368,9 @@ int amdtee_map_shmem(struct tee_shm *shm) shmnode->kaddr = shm->kaddr; shmnode->buf_id = buf_id; ctxdata = shm->ctx->data; + mutex_lock(&ctxdata->shm_mutex); list_add(&shmnode->shm_node, &ctxdata->shm_list); + mutex_unlock(&ctxdata->shm_mutex); pr_debug("buf_id :[%x] kaddr[%p]\n", shmnode->buf_id, shmnode->kaddr); @@ -385,12 +391,14 @@ void amdtee_unmap_shmem(struct tee_shm *shm) handle_unmap_shmem(buf_id); ctxdata = shm->ctx->data; + mutex_lock(&ctxdata->shm_mutex); list_for_each_entry(shmnode, &ctxdata->shm_list, shm_node) if (buf_id == shmnode->buf_id) { list_del(&shmnode->shm_node); kfree(shmnode); break; } + mutex_unlock(&ctxdata->shm_mutex); } int amdtee_invoke_func(struct tee_context *ctx,