tee: amdtee: synchronize access to shm list

Synchronize access to shm or shared memory buffer list to prevent
race conditions due to concurrent updates to shared shm list by
multiple threads.

Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver")
Reviewed-by: Devaraj Rangasamy <Devaraj.Rangasamy@amd.com>
Signed-off-by: Rijo Thomas <Rijo-john.Thomas@amd.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

diff --git a/drivers/tee/amdtee/amdtee_private.h b/drivers/tee/amdtee/amdtee_private.h
index 97df16a..337c8d8 100644 (file)
--- a/drivers/tee/amdtee/amdtee_private.h
+++ b/drivers/tee/amdtee/amdtee_private.h
@@ -70,6 +70,7 @@ struct amdtee_session {
 struct amdtee_context_data {
        struct list_head sess_list;
        struct list_head shm_list;
+       struct mutex shm_mutex;   /* synchronizes access to @shm_list */
 };
 
 struct amdtee_driver_data {

diff --git a/drivers/tee/amdtee/core.c b/drivers/tee/amdtee/core.c
index ce61c68..8a6a8f3 100644 (file)
--- a/drivers/tee/amdtee/core.c
+++ b/drivers/tee/amdtee/core.c
@@ -42,6 +42,7 @@ static int amdtee_open(struct tee_context *ctx)
 
        INIT_LIST_HEAD(&ctxdata->sess_list);
        INIT_LIST_HEAD(&ctxdata->shm_list);
+       mutex_init(&ctxdata->shm_mutex);
 
        ctx->data = ctxdata;
        return 0;
@@ -85,6 +86,7 @@ static void amdtee_release(struct tee_context *ctx)
                list_del(&sess->list_node);
                release_session(sess);
        }
+       mutex_destroy(&ctxdata->shm_mutex);
        kfree(ctxdata);
 
        ctx->data = NULL;
@@ -155,11 +157,13 @@ u32 get_buffer_id(struct tee_shm *shm)
        struct amdtee_shm_data *shmdata;
        u32 buf_id = 0;
 
+       mutex_lock(&ctxdata->shm_mutex);
        list_for_each_entry(shmdata, &ctxdata->shm_list, shm_node)
                if (shmdata->kaddr == shm->kaddr) {
                        buf_id = shmdata->buf_id;
                        break;
                }
+       mutex_unlock(&ctxdata->shm_mutex);
 
        return buf_id;
 }
@@ -364,7 +368,9 @@ int amdtee_map_shmem(struct tee_shm *shm)
        shmnode->kaddr = shm->kaddr;
        shmnode->buf_id = buf_id;
        ctxdata = shm->ctx->data;
+       mutex_lock(&ctxdata->shm_mutex);
        list_add(&shmnode->shm_node, &ctxdata->shm_list);
+       mutex_unlock(&ctxdata->shm_mutex);
 
        pr_debug("buf_id :[%x] kaddr[%p]\n", shmnode->buf_id, shmnode->kaddr);
 
@@ -385,12 +391,14 @@ void amdtee_unmap_shmem(struct tee_shm *shm)
        handle_unmap_shmem(buf_id);
 
        ctxdata = shm->ctx->data;
+       mutex_lock(&ctxdata->shm_mutex);
        list_for_each_entry(shmnode, &ctxdata->shm_list, shm_node)
                if (buf_id == shmnode->buf_id) {
                        list_del(&shmnode->shm_node);
                        kfree(shmnode);
                        break;
                }
+       mutex_unlock(&ctxdata->shm_mutex);
 }
 
 int amdtee_invoke_func(struct tee_context *ctx,