fix(tee): reject invalid session in invoke to close NULL-deref DoS (#247)

tee_ioctl_invoke() did not check the result of tee_ta_get_session().
A non-secure caller could send TEE_IOC_INVOKE with an invalid, zero, or
stale session id; find_session() returns NULL and tee_ta_invoke_command()
then dereferences it (sess->ctx->ops->enter_invoke_cmd, the original
guards are commented out), faulting in the secure world -> DoS reachable
through the live cmse_nonsecure_entry ioctl veneer.

Reject a NULL session with TEEC_ERROR_BAD_PARAMETERS in tee_ioctl_invoke
before the session is used, and add a defense-in-depth NULL guard at the
top of tee_ta_invoke_command() so no caller can trigger the dereference.

close_session is unaffected: tee_ta_close_session() already handles NULL.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: 2 people

tee/kernel/entry_std.c

@@ -406,6 +406,19 @@ TEEC_Result tee_ioctl_invoke(/*ctx,*/ struct tee_ioctl_buf_data *buf_data)
   if (res != TEE_SUCCESS)
     goto out;
 
+  if (!sess) {
+    /*
+     * A Non-Secure caller can supply an invalid/zero/stale session id.
+     * find_session() then returns NULL and, since the guards in
+     * tee_ta_invoke_command() are disabled, the secure world would
+     * dereference NULL (sess->ctx->...) -> secure-world crash/DoS.
+     * Reject before invoking. Placed after copy_in_params so a malformed
+     * request still gets the more specific error from parameter validation.
+     */
+    res = TEEC_ERROR_BAD_PARAMETERS;
+    goto out;
+  }
+
   res = tee_ta_invoke_command(&err, sess, arg->func, &param);
 
   copy_out_param(&param, arg->num_params, arg->params, saved_attr);

tee/kernel/tee_ta_manager.c

@@ -637,6 +637,15 @@ TEE_Result tee_ta_invoke_command(TEE_ErrorOrigin *err,
 {
 	TEE_Result res;
 
+	/*
+	 * Defense in depth: never dereference a NULL session. Callers (e.g. the
+	 * Non-Secure ioctl veneer) obtain sess from tee_ta_get_session(), which
+	 * returns NULL for an unknown session id; without this guard the line
+	 * below would fault in the secure world.
+	 */
+	if (!sess)
+		return TEE_ERROR_BAD_PARAMETERS;
+
 //	if (check_client(sess, clnt_id) != TEE_SUCCESS)
 //		return TEE_ERROR_BAD_PARAMETERS; /* intentional generic error */
 //