diff options
| author | Jann Horn <jannh@google.com> | 2018-04-04 21:03:21 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-05-22 18:53:57 +0200 |
| commit | bca7faea5410d50d2a3be4b11688f02a2fb2ee95 (patch) | |
| tree | 093b493e04502d500fd1d0aeac804b88abd938ef /drivers/tee | |
| parent | 9a19a93bddb383548a04afaf40cec847de6296f8 (diff) | |
tee: shm: fix use-after-free via temporarily dropped reference
commit bb765d1c331f62b59049d35607ed2e365802bef9 upstream.
Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().
This code can only be triggered on ARM systems that use Linaro's OP-TEE.
Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/tee')
| -rw-r--r-- | drivers/tee/tee_shm.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 4bc7956cefc4..ea3ce4e17b85 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -203,9 +203,10 @@ int tee_shm_get_fd(struct tee_shm *shm) if ((shm->flags & req_flags) != req_flags) return -EINVAL; + get_dma_buf(shm->dmabuf); fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC); - if (fd >= 0) - get_dma_buf(shm->dmabuf); + if (fd < 0) + dma_buf_put(shm->dmabuf); return fd; } |