AMDTEE fix race condition in amdtee_open_session()

* tag 'amdtee-fix-for-v6.3' of https://git.linaro.org/people/jens.wiklander/linux-tee:
  tee: amdtee: fix race condition in amdtee_open_session

Link: https://lore.kernel.org/r/Y/5ZGX0lSTnZz27E@rayden
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

There is a potential race condition in amdtee_open_session that may
lead to use-after-free. For instance, in amdtee_open_session() after
sess->sess_mask is set, and before setting:

    sess->session_info[i] = session_info;

if amdtee_close_session() closes this same session, then 'sess' data
structure will be released, causing kernel panic when 'sess' is
accessed within amdtee_open_session().

The solution is to set the bit sess->sess_mask as the last step in
amdtee_open_session().

Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver")
Cc: stable@vger.kernel.org
Signed-off-by: Rijo Thomas <Rijo-john.Thomas@amd.com>
Acked-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Pull driver core updates from Greg KH:
 "Here is the large set of driver core changes for 6.3-rc1.

  There's a lot of changes this development cycle, most of the work
  falls into two different categories:

   - fw_devlink fixes and updates. This has gone through numerous review
     cycles and lots of review and testing by lots of different devices.
     Hopefully all should be good now, and Saravana will be keeping a
     watch for any potential regression on odd embedded systems.

   - driver core changes to work to make struct bus_type able to be
     moved into read-only memory (i.e. const) The recent work with Rust
     has pointed out a number of areas in the driver core where we are
     passing around and working with structures that really do not have
     to be dynamic at all, and they should be able to be read-only
     making things safer overall. This is the contuation of that work
     (started last release with kobject changes) in moving struct
     bus_type to be constant. We didn't quite make it for this release,
     but the remaining patches will be finished up for the release after
     this one, but the groundwork has been laid for this effort.

  Other than that we have in here:

   - debugfs memory leak fixes in some subsystems

   - error path cleanups and fixes for some never-able-to-be-hit
     codepaths.

   - cacheinfo rework and fixes

   - Other tiny fixes, full details are in the shortlog

  All of these have been in linux-next for a while with no reported
  problems"

[ Geert Uytterhoeven points out that that last sentence isn't true, and
  that there's a pending report that has a fix that is queued up - Linus ]

* tag 'driver-core-6.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core: (124 commits)
  debugfs: drop inline constant formatting for ERR_PTR(-ERROR)
  OPP: fix error checking in opp_migrate_dentry()
  debugfs: update comment of debugfs_rename()
  i3c: fix device.h kernel-doc warnings
  dma-mapping: no need to pass a bus_type into get_arch_dma_ops()
  driver core: class: move EXPORT_SYMBOL_GPL() lines to the correct place
  Revert "driver core: add error handling for devtmpfs_create_node()"
  Revert "devtmpfs: add debug info to handle()"
  Revert "devtmpfs: remove return value of devtmpfs_delete_node()"
  driver core: cpu: don't hand-override the uevent bus_type callback.
  devtmpfs: remove return value of devtmpfs_delete_node()
  devtmpfs: add debug info to handle()
  driver core: add error handling for devtmpfs_create_node()
  driver core: bus: update my copyright notice
  driver core: bus: add bus_get_dev_root() function
  driver core: bus: constify bus_unregister()
  driver core: bus: constify some internal functions
  driver core: bus: constify bus_get_kset()
  driver core: bus: constify bus_register/unregister_notifier()
  driver core: remove private pointer from struct bus_type
  ...

The kernel pages used by shm_get_kernel_pages() are allocated using
GFP_KERNEL through the following call stack:

trusted_instantiate()
	trusted_payload_alloc() -> GFP_KERNEL
	<trusted key op>
		tee_shm_register_kernel_buf()
			register_shm_helper()
				shm_get_kernel_pages()

Where <trusted key op> is one of:

	trusted_key_unseal()
	trusted_key_get_random()
	trusted_key_seal()

Because the pages can't be from highmem get_kernel_pages() boils down to
a get_page() call.

Remove the get_kernel_pages() call and open code the get_page().

In case a highmem page does slip through warn on once for a kmap'ed
address.

Cc: Jens Wiklander <jens.wiklander@linaro.org>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: "Fabio M. De Francesco" <fmdefrancesco@gmail.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

The kernel pages used by shm_get_kernel_pages() are allocated using
GFP_KERNEL through the following call stack:

trusted_instantiate()
	trusted_payload_alloc() -> GFP_KERNEL
	<trusted key op>
		tee_shm_register_kernel_buf()
			register_shm_helper()
				shm_get_kernel_pages()

Where <trusted key op> is one of:

	trusted_key_unseal()
	trusted_key_get_random()
	trusted_key_seal()

Remove the vmalloc page support from shm_get_kernel_pages().  Replace
with a warn on once.

Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: "Fabio M. De Francesco" <fmdefrancesco@gmail.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Ira Weiny <ira.weiny@intel.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

The uevent() callback in struct bus_type should not be modifying the
device that is passed into it, so mark it as a const * and propagate the
function signature changes out into all relevant subsystems that use
this callback.

Acked-by: Rafael J. Wysocki <rafael@kernel.org>
Acked-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20230111113018.459199-16-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Pull ARM SoC driver updates from Arnd Bergmann:
 "There are few major updates in the SoC specific drivers, mainly the
  usual reworks and support for variants of the existing SoC. While this
  remains Arm centric for the most part, the branch now also contains
  updates to risc-v and loongarch specific code in drivers/soc/.

  Notable changes include:

   - Support for the newly added Qualcomm Snapdragon variants (MSM8956,
     MSM8976, SM6115, SM4250, SM8150, SA8155 and SM8550) in the soc ID,
     rpmh, rpm, spm and powerdomain drivers.

   - Documentation for the somewhat controversial qcom,board-id
     properties that are required for booting a number of machines

   - A new SoC identification driver for the loongson-2 (loongarch)
     platform

   - memory controller updates for stm32, tegra, and renesas.

   - a new DT binding to better describe LPDDR2/3/4/5 chips in the
     memory controller subsystem

   - Updates for Tegra specific drivers across multiple subsystems,
     improving support for newer SoCs and better identification

   - Minor fixes for Broadcom, Freescale, Apple, Renesas, Sifive, TI,
     Mediatek and Marvell SoC drivers"

* tag 'soc-drivers-6.2' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc: (137 commits)
  soc: qcom: socinfo: Add SM6115 / SM4250 SoC IDs to the soc_id table
  dt-bindings: arm: qcom,ids: Add SoC IDs for SM6115 / SM4250 and variants
  soc: qcom: socinfo: Add SM8150 and SA8155 SoC IDs to the soc_id table
  dt-bindings: arm: qcom,ids: Add SoC IDs for SM8150 and SA8155
  dt-bindings: soc: qcom: apr: document generic qcom,apr compatible
  soc: qcom: Select REMAP_MMIO for ICC_BWMON driver
  soc: qcom: Select REMAP_MMIO for LLCC driver
  soc: qcom: rpmpd: Add SM4250 support
  dt-bindings: power: rpmpd: Add SM4250 support
  dt-bindings: soc: qcom: aoss: Add compatible for SM8550
  soc: qcom: llcc: Add configuration data for SM8550
  dt-bindings: arm: msm: Add LLCC compatible for SM8550
  soc: qcom: llcc: Add v4.1 HW version support
  soc: qcom: socinfo: Add SM8550 ID
  soc: qcom: rpmh-rsc: Avoid unnecessary checks on irq-done response
  soc: qcom: rpmh-rsc: Add support for RSC v3 register offsets
  soc: qcom: rpmhpd: Add SM8550 power domains
  dt-bindings: power: rpmpd: Add SM8550 to rpmpd binding
  soc: qcom: socinfo: Add MSM8956/76 SoC IDs to the soc_id table
  dt-bindings: arm: qcom,ids: Add SoC IDs for MSM8956 and MSM8976
  ...

Add missing __init/__exit annotations to OP-TEE driver

* tag 'optee-for-6.2' of https://git.linaro.org/people/jens.wiklander/linux-tee:
  optee: Add __init/__exit annotations to module init/exit funcs

Link: https://lore.kernel.org/r/Y3d4CHWl3Ofx5OrX@jade
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

If device_register() returns error in optee_register_device(),
the name allocated by dev_set_name() need be freed. As comment
of device_register() says, it should use put_device() to give
up the reference in the error path. So fix this by calling
put_device(), then the name can be freed in kobject_cleanup(),
and optee_device is freed in optee_release_device().

Fixes: c3fa24af9244 ("tee: optee: add TEE bus device enumeration support")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Add missing __init/__exit annotations to module init/exit funcs.

Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Xiu Jianfeng <xiujianfeng@huawei.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>