shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-03-24 19:40:21 +09:00
Code Issues Packages Projects Releases Wiki Activity

UPSTREAM: tee: shm: fix use-after-free via temporarily dropped reference

Browse Source 
Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().

This code can only be triggered on ARM systems that use Linaro's OP-TEE.

Fixes: 967c9cca2c ("tee: generic TEE subsystem")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
(cherry picked from commit bb765d1c33)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I21f905548f65e82ec8bf3c09775856a6f0fb057f
This commit is contained in:
Jann Horn
2018-04-04 21:03:21 +02:00
committed by Chris
parent 20c72a6f3a
commit cfa69012ea
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/tee/tee_shm.c
View File

@@ -360,9 +360,10 @@ int tee_shm_get_fd(struct tee_shm *shm)
if (!(shm->flags & TEE_SHM_DMA_BUF))
return -EINVAL;
get_dma_buf(shm->dmabuf);
fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);
if (fd >= 0)
get_dma_buf(shm->dmabuf);
if (fd < 0)
dma_buf_put(shm->dmabuf);
return fd;
}