Dead lock for multi-session about optee_os HOT 13 CLOSED

diff --git a/core/kernel/tee_ta_manager.c b/core/kernel/tee_ta_manager.c
index b9fd3201e..9e2c84cbe 100644
--- a/core/kernel/tee_ta_manager.c
+++ b/core/kernel/tee_ta_manager.c
@@ -727,6 +727,7 @@ TEE_Result tee_ta_open_session(TEE_ErrorOrigin *err,

        if (!ctx || ctx->panicked) {
                DMSG("panicked, call tee_ta_close_session()");
+               tee_ta_put_session(s);
                tee_ta_close_session(s, open_sessions, KERN_IDENTITY);
                *err = TEE_ORIGIN_TEE;
                return TEE_ERROR_TARGET_DEAD;

diff --git a/core/kernel/tee_ta_manager.c b/core/kernel/tee_ta_manager.c
index b9fd3201e..0f5fd6879 100644
--- a/core/kernel/tee_ta_manager.c
+++ b/core/kernel/tee_ta_manager.c
@@ -793,14 +794,14 @@ TEE_Result tee_ta_invoke_command(TEE_ErrorOrigin *err,
        }

        ta_ctx = ts_to_ta_ctx(ts_ctx);
-       if (ta_ctx->panicked) {
-               DMSG("Panicked !");
-               destroy_ta_ctx_from_session(sess);
+       if (!ta_ctx) {
                *err = TEE_ORIGIN_TEE;
                return TEE_ERROR_TARGET_DEAD;
        }

        tee_ta_set_busy(ta_ctx);
+       if (ta_ctx->panicked)
+               goto out;

        sess->param = param;
        set_invoke_timeout(sess, cancel_req_to);
@@ -809,7 +810,9 @@ TEE_Result tee_ta_invoke_command(TEE_ErrorOrigin *err,
        sess->param = NULL;
        tee_ta_clear_busy(ta_ctx);

+out:
        if (ta_ctx->panicked) {
+               DMSG("Panicked !");
                destroy_ta_ctx_from_session(sess);
                *err = TEE_ORIGIN_TEE;
                return TEE_ERROR_TARGET_DEAD;

diff --git a/core/kernel/pseudo_ta.c b/core/kernel/pseudo_ta.c
index 0a85eda96..9defd0623 100644
--- a/core/kernel/pseudo_ta.c
+++ b/core/kernel/pseudo_ta.c
@@ -247,7 +247,7 @@ static const struct ts_ops pseudo_ta_ops = {

 bool is_pseudo_ta_ctx(struct ts_ctx *ctx)
 {
-       return ctx->ops == &pseudo_ta_ops;
+       return ctx && ctx->ops == &pseudo_ta_ops;
 }

diff --git a/core/include/kernel/user_mode_ctx.h b/core/include/kernel/user_mode_ctx.h
index 6d65d1470..2424808f4 100644
--- a/core/include/kernel/user_mode_ctx.h
+++ b/core/include/kernel/user_mode_ctx.h
@@ -25,8 +25,10 @@ static inline struct user_mode_ctx *to_user_mode_ctx(struct ts_ctx *ctx)
                return &to_user_ta_ctx(ctx)->uctx;
        else if (is_sp_ctx(ctx))
                return &to_sp_ctx(ctx)->uctx;
-       else
+       else if (is_stmm_ctx(ctx))
                return &to_stmm_ctx(ctx)->uctx;
+       else
+               panic("no such ctx");
 }

to_user_mode_ctx: panic("no such ctx");
ts_to_ta_ctx: panic("bad context");

Thread 1 trigger panic, and running in user mode or other steps,
Then thread 2 destroy the ctx.
Thread 1 still running  with invalid ctx and panicked.