Files
linux/include/linux
Jens Wiklander b4a661b421 tee: handle lookup of shm with reference count 0
commit dfd0743f1d upstream.

Since the tee subsystem does not keep a strong reference to its idle
shared memory buffers, it races with other threads that try to destroy a
shared memory through a close of its dma-buf fd or by unmapping the
memory.

In tee_shm_get_from_id() when a lookup in teedev->idr has been
successful, it is possible that the tee_shm is in the dma-buf teardown
path, but that path is blocked by the teedev mutex. Since we don't have
an API to tell if the tee_shm is in the dma-buf teardown path or not we
must find another way of detecting this condition.

Fix this by doing the reference counting directly on the tee_shm using a
new refcount_t refcount field. dma-buf is replaced by using
anon_inode_getfd() instead, this separates the life-cycle of the
underlying file from the tee_shm. tee_shm_put() is updated to hold the
mutex when decreasing the refcount to 0 and then remove the tee_shm from
teedev->idr before releasing the mutex. This means that the tee_shm can
never be found unless it has a refcount larger than 0.

Fixes: 967c9cca2c ("tee: generic TEE subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Lars Persson <larper@axis.com>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Reported-by: Patrik Lantz <patrik.lantz@axis.com>
[JW: backport to 4.19-stable]
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2022-01-05 12:34:57 +01:00
..
2019-12-13 08:51:18 +01:00
2021-04-14 08:22:36 +02:00
2018-05-26 09:16:44 +02:00
2018-06-15 18:10:01 -03:00
2019-10-05 13:10:03 +02:00
2019-07-03 13:14:48 +02:00
2018-05-09 17:25:13 +02:00
2017-11-15 18:21:04 -08:00
2018-06-15 18:10:01 -03:00
2018-06-19 10:06:29 -07:00
2018-03-26 15:09:38 +02:00
2018-08-22 10:52:48 -07:00
2017-08-24 13:23:03 -07:00
2018-01-01 12:40:27 -07:00
2019-11-24 08:19:14 +01:00
2017-08-07 17:22:14 +02:00
2021-12-08 08:50:13 +01:00
2017-11-13 01:41:20 +01:00
2021-12-08 08:50:13 +01:00
2018-07-27 09:57:23 +10:00
2021-01-30 13:32:12 +01:00
2018-06-28 20:32:51 +09:00
2019-10-17 13:45:42 -07:00
2018-03-26 08:53:43 -06:00
2021-05-22 10:59:50 +02:00
2018-08-08 11:06:20 +02:00
2018-06-22 13:43:27 +09:00
2019-12-13 08:52:43 +01:00
2021-03-04 09:39:44 +01:00
2018-04-11 10:28:38 -07:00
2017-11-15 18:21:01 -08:00
2021-02-07 14:48:38 +01:00
2018-07-12 21:35:28 +02:00
2021-11-26 11:35:57 +01:00
2017-12-01 13:09:40 -08:00
2018-04-12 09:41:19 -07:00
2017-08-28 20:51:22 +02:00
2018-06-07 17:34:35 -07:00
2018-04-11 10:28:32 -07:00
2019-12-31 16:35:38 +01:00
2021-07-11 12:49:26 +02:00
2020-07-29 10:16:52 +02:00
2018-06-07 17:34:39 -07:00
2018-03-26 13:14:43 -04:00
2018-03-26 13:14:43 -04:00
2021-06-30 08:48:18 -04:00
2018-08-22 10:52:45 -07:00
2018-01-28 22:17:24 -05:00
2017-07-25 18:05:25 +02:00
2018-01-08 08:22:45 -06:00
2018-07-10 17:22:35 +02:00
2018-01-08 08:22:45 -06:00
2021-09-03 09:58:00 +02:00
2018-06-07 17:34:36 -07:00
2018-01-31 17:18:37 -08:00
2017-11-09 10:23:28 +01:00
2018-07-19 11:34:23 +01:00
2020-03-18 07:14:17 +01:00
2017-11-17 16:10:04 -08:00
2018-07-21 10:43:12 -05:00
2017-11-13 01:33:48 +01:00
2017-12-16 02:05:48 +01:00
2018-05-31 00:13:56 +08:00
2019-06-11 12:20:52 +02:00
2018-07-20 01:11:45 +02:00
2018-05-11 17:28:45 -07:00
2018-05-11 17:28:45 -07:00
2021-12-14 10:18:04 +01:00
2018-03-01 08:33:05 -07:00
2017-11-07 12:22:21 +01:00
2018-06-29 08:48:06 -06:00
2020-04-02 15:28:22 +02:00
2018-06-07 17:34:35 -07:00
2018-07-07 17:25:23 +02:00
2018-08-16 12:14:42 -07:00
2018-01-15 12:07:46 -08:00
2018-06-20 11:35:56 +02:00
2018-02-06 18:32:47 -08:00
2018-11-13 11:08:51 -08:00
2020-12-11 13:25:01 +01:00
2018-02-06 18:32:44 -08:00
2017-12-20 09:53:54 -07:00
2020-04-02 15:28:23 +02:00
2021-12-14 10:18:06 +01:00
2017-08-15 09:02:07 -07:00
2017-08-15 09:02:08 -07:00