Commit bb765d1c authored Apr 04, 2018 by Jann Horn Committed by Jens Wiklander May 07, 2018

tee: shm: fix use-after-free via temporarily dropped reference



Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().

This code can only be triggered on ARM systems that use Linaro's OP-TEE.

Fixes: 967c9cca ("tee: generic TEE subsystem")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

parent 75bc37fe

drivers/tee/tee_shm.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -360,9 +360,10 @@ int tee_shm_get_fd(struct tee_shm *shm)
		if (!(shm->flags & TEE_SHM_DMA_BUF))
		return -EINVAL;

		fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);
		if (fd >= 0)
		get_dma_buf(shm->dmabuf);
		fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);
		if (fd < 0)
		dma_buf_put(shm->dmabuf);
		return fd;
		}

Admin message