Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 18ef8693 authored by Jann Horn's avatar Jann Horn Committed by Greg Kroah-Hartman
Browse files

UPSTREAM: tee: shm: fix use-after-free via temporarily dropped reference 



Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().

This code can only be triggered on ARM systems that use Linaro's OP-TEE.

Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem")
Signed-off-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarJens Wiklander <jens.wiklander@linaro.org>
(cherry picked from commit bb765d1c331f62b59049d35607ed2e365802bef9)
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
Change-Id: I21f905548f65e82ec8bf3c09775856a6f0fb057f
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@google.com>
parent 059ab9b8

drivers/tee/tee_shm.c

+3 −2
Original line number Diff line number Diff line
@@ -360,9 +360,10 @@ int tee_shm_get_fd(struct tee_shm *shm) 
	if (!(shm->flags & TEE_SHM_DMA_BUF))

		return -EINVAL;



	fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);

	if (fd >= 0)

	get_dma_buf(shm->dmabuf);

	fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);

	if (fd < 0)

		dma_buf_put(shm->dmabuf);

	return fd;

}