redonkable
/
remarkable-linux
1
0
Fork 0
Code Releases Activity

tee: shm: fix use-after-free via temporarily dropped reference 

commit bb765d1c33 upstream.

Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().

This code can only be triggered on ARM systems that use Linaro's OP-TEE.

Fixes: 967c9cca2c ("tee: generic TEE subsystem")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
pull/10/head
Jann Horn 2018-04-04 21:03:21 +02:00 committed by Greg Kroah-Hartman
parent 9a19a93bdd
commit bca7faea54
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/tee/tee_shm.c
View File

@ -203,9 +203,10 @@ int tee_shm_get_fd(struct tee_shm *shm)
if ((shm->flags & req_flags) != req_flags)
return -EINVAL;
get_dma_buf(shm->dmabuf);
fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);
if (fd >= 0)
get_dma_buf(shm->dmabuf);
if (fd < 0)
dma_buf_put(shm->dmabuf);
return fd;
}