From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-19.7 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 77C33C433B4 for ; Sun, 2 May 2021 14:09:01 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 522C861026 for ; Sun, 2 May 2021 14:09:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234094AbhEBOJt (ORCPT ); Sun, 2 May 2021 10:09:49 -0400 Received: from mail.kernel.org ([198.145.29.99]:51698 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233713AbhEBOHK (ORCPT ); Sun, 2 May 2021 10:07:10 -0400 Received: by mail.kernel.org (Postfix) with ESMTPSA id 17136613D4; Sun, 2 May 2021 14:05:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1619964356; bh=KIUAsv44XSVhl9cP5lf08lV/sYIea37rPg1fp9uDyKE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Cso8eQGqbw6zBFW1rWYHv9/w6HLn4w43NU50rWuyN+Mgm1BpEg8WhOjZ1ikg6n8a4 zOVmGoZ9TDX7foU28xVIVbb7J6TQDVBD1YfC7OhzxTRwD3V9NjYauztT3LZRsXC2H8 rQRMavYk8Qsiso0ZYRNuFp+HMi9xOyjz5ZFemmNjtaKGCc2+bedzkFx6dPzz3DKTu1 7vygisffcL4mwPTkUfq1hqS1ms5Wb0r8bv0pkc6znQMP3auiJx7Q9gJYZElOwwD6l6 AReNvIG6q+e1X8XqJBS6qvQ/Efp6ZBfk8uxRHkdnK+vu1h8u2Y2Hq5MrzSzwB/ftzk NjuGzwn0xM7eQ== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Jerome Forissier , Sumit Garg , Jens Wiklander , Sasha Levin , op-tee@lists.trustedfirmware.org Subject: [PATCH AUTOSEL 4.14 09/16] tee: optee: do not check memref size on return from Secure World Date: Sun, 2 May 2021 10:05:37 -0400 Message-Id: <20210502140544.2720138-9-sashal@kernel.org> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20210502140544.2720138-1-sashal@kernel.org> References: <20210502140544.2720138-1-sashal@kernel.org> MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jerome Forissier [ Upstream commit c650b8dc7a7910eb25af0aac1720f778b29e679d ] When Secure World returns, it may have changed the size attribute of the memory references passed as [in/out] parameters. The GlobalPlatform TEE Internal Core API specification does not restrict the values that this size can take. In particular, Secure World may increase the value to be larger than the size of the input buffer to indicate that it needs more. Therefore, the size check in optee_from_msg_param() is incorrect and needs to be removed. This fixes a number of failed test cases in the GlobalPlatform TEE Initial Configuratiom Test Suite v2_0_0_0-2017_06_09 when OP-TEE is compiled without dynamic shared memory support (CFG_CORE_DYN_SHM=n). Reviewed-by: Sumit Garg Suggested-by: Jens Wiklander Signed-off-by: Jerome Forissier Signed-off-by: Jens Wiklander Signed-off-by: Sasha Levin --- drivers/tee/optee/core.c | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c index 834884c370c5..63187b07dde0 100644 --- a/drivers/tee/optee/core.c +++ b/drivers/tee/optee/core.c @@ -86,16 +86,6 @@ int optee_from_msg_param(struct tee_param *params, size_t num_params, return rc; p->u.memref.shm_offs = mp->u.tmem.buf_ptr - pa; p->u.memref.shm = shm; - - /* Check that the memref is covered by the shm object */ - if (p->u.memref.size) { - size_t o = p->u.memref.shm_offs + - p->u.memref.size - 1; - - rc = tee_shm_get_pa(shm, o, NULL); - if (rc) - return rc; - } break; default: return -EINVAL; -- 2.30.2