]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: a0dcdc4) | patch
tee: amdtee: out of bounds read in find_session()
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 27 Feb 2020 16:19:54 +0000 (19:19 +0300)
committerJens Wiklander <jens.wiklander@linaro.org>
Tue, 10 Mar 2020 07:12:04 +0000 (08:12 +0100)
commit54ae9584126dfb04556ff864033aa0ba58f84af6
tree8522be7349384c78ca9d49dd10745c6c80265eectree | snapshot
parenta0dcdc4ca64230a6d4a2738a96d502ae7293732ccommit | diff
tee: amdtee: out of bounds read in find_session()

The "index" is a user provided value from 0-USHRT_MAX.  If it's over
TEE_NUM_SESSIONS (31) then it results in an out of bounds read when we
call test_bit(index, sess->sess_mask).

Fixes: a1be16c860f4 ("tee: add AMD-TEE driver")
Acked-by: Rijo Thomas <Rijo-john.Thomas@amd.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
drivers/tee/amdtee/core.c diff | blob | history
Linux Kernel Source Tree.