Jann Horn cfa69012ea UPSTREAM: tee: shm: fix use-after-free via temporarily dropped reference ...

Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().

This code can only be triggered on ARM systems that use Linaro's OP-TEE.

Fixes: 967c9cca2c ("tee: generic TEE subsystem")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
(cherry picked from commit bb765d1c33)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I21f905548f65e82ec8bf3c09775856a6f0fb057f

2023-05-16 09:46:44 +09:00

..

optee

Amlogic: sync the code from mainline. [1/1]

2020-02-04 13:48:58 +09:00

Kconfig

BACKPORT: tee: add ARM_SMCCC dependency

2018-01-12 16:44:40 +00:00

Makefile

BACKPORT: tee: add OP-TEE driver

2017-12-05 14:00:44 +00:00

tee_core.c

BACKPORT: tee: use reference counting for tee_context

2018-02-21 15:40:43 +00:00

tee_private.h

BACKPORT: tee: use reference counting for tee_context

2018-02-21 15:40:43 +00:00

tee_shm_pool.c

BACKPORT: tee: flexible shared memory pool creation

2018-02-21 15:40:42 +00:00

tee_shm.c

UPSTREAM: tee: shm: fix use-after-free via temporarily dropped reference

2023-05-16 09:46:44 +09:00