diff options
| author | Jann Horn <jannh@google.com> | 2018-04-04 21:03:21 +0200 |
|---|---|---|
| committer | Jens Wiklander <jens.wiklander@linaro.org> | 2018-05-07 11:50:25 +0200 |
| commit | bb765d1c331f62b59049d35607ed2e365802bef9 (patch) | |
| tree | 08178bf9dce45a1fd175e1a6cf65f58b91d6f0b8 /drivers/tee | |
| parent | 75bc37fefc4471e718ba8e651aa74673d4e0a9eb (diff) | |
| download | linux-0-day-bb765d1c331f62b59049d35607ed2e365802bef9.tar.gz linux-0-day-bb765d1c331f62b59049d35607ed2e365802bef9.tar.xz | |
tee: shm: fix use-after-free via temporarily dropped reference
Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().
This code can only be triggered on ARM systems that use Linaro's OP-TEE.
Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Diffstat (limited to 'drivers/tee')
| -rw-r--r-- | drivers/tee/tee_shm.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 556960a1bab3b..07d3be6f0780d 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -360,9 +360,10 @@ int tee_shm_get_fd(struct tee_shm *shm) if (!(shm->flags & TEE_SHM_DMA_BUF)) return -EINVAL; + get_dma_buf(shm->dmabuf); fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC); - if (fd >= 0) - get_dma_buf(shm->dmabuf); + if (fd < 0) + dma_buf_put(shm->dmabuf); return fd; } |