mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-25 21:24:08 +08:00
tee: shm: fix use-after-free via temporarily dropped reference
Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().
This code can only be triggered on ARM systems that use Linaro's OP-TEE.
Fixes: 967c9cca2c
("tee: generic TEE subsystem")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
This commit is contained in:
parent
75bc37fefc
commit
bb765d1c33
@ -360,9 +360,10 @@ int tee_shm_get_fd(struct tee_shm *shm)
|
||||
if (!(shm->flags & TEE_SHM_DMA_BUF))
|
||||
return -EINVAL;
|
||||
|
||||
get_dma_buf(shm->dmabuf);
|
||||
fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);
|
||||
if (fd >= 0)
|
||||
get_dma_buf(shm->dmabuf);
|
||||
if (fd < 0)
|
||||
dma_buf_put(shm->dmabuf);
|
||||
return fd;
|
||||
}
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user