Jann Horn 3c079e40ee tee: shm: fix use-after-free via temporarily dropped reference ...

commit bb765d1c33 upstream.

Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().

This code can only be triggered on ARM systems that use Linaro's OP-TEE.

Fixes: 967c9cca2c ("tee: generic TEE subsystem")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2018-05-22 18:56:21 +02:00

..

optee

Merge tag 'tee-drv-dynamic-shm+fixes-for-v4.16' of https://git.linaro.org/people/jens.wiklander/linux-tee into next/drivers

2018-01-11 18:05:06 -08:00

Kconfig

tee: add ARM_SMCCC dependency

2017-05-10 21:05:16 +02:00

Makefile

License cleanup: add SPDX GPL-2.0 license identifier to files with no license

2017-11-02 11:10:55 +01:00

tee_core.c

Merge tag 'tee-drv-dynamic-shm-for-v4.16' of https://git.linaro.org/people/jens.wiklander/linux-tee into next/drivers

2017-12-21 17:23:52 +01:00

tee_private.h

tee: use reference counting for tee_context

2017-12-15 13:36:18 +01:00

tee_shm_pool.c

tee: flexible shared memory pool creation

2017-12-15 12:37:29 +01:00

tee_shm.c

tee: shm: fix use-after-free via temporarily dropped reference

2018-05-22 18:56:21 +02:00