projects / linux-block.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 75bc37f) | patch
tee: shm: fix use-after-free via temporarily dropped reference
authorJann Horn <jannh@google.com>
Wed, 4 Apr 2018 19:03:21 +0000 (21:03 +0200)
committerJens Wiklander <jens.wiklander@linaro.org>
Mon, 7 May 2018 09:50:25 +0000 (11:50 +0200)
commitbb765d1c331f62b59049d35607ed2e365802bef9
tree08178bf9dce45a1fd175e1a6cf65f58b91d6f0b8tree | snapshot
parent75bc37fefc4471e718ba8e651aa74673d4e0a9ebcommit | diff
tee: shm: fix use-after-free via temporarily dropped reference

Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().

This code can only be triggered on ARM systems that use Linaro's OP-TEE.

Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
drivers/tee/tee_shm.c diff | blob | blame | history
Linux 6.x block layer and io_uring tree(s)