Merge tag 'tee-drv-fixes-for-4.17' of git://git.linaro.org/people/jens.wiklander...

Small fixes for tee subsystem

* Fixes for use-after-free via temporarily dropped reference
* Checks that passed shm references are consistent in offset/size
  with regards to the shm object

* tag 'tee-drv-fixes-for-4.17' of git://git.linaro.org/people/jens.wiklander/linux-tee:
  tee: check shm references are consistent in offset/size
  tee: shm: fix use-after-free via temporarily dropped reference

Signed-off-by: Olof Johansson <olof@lixom.net>

diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
index 0124a91c8d7139cd6840cfffeea64adc1cd1825c..dd46b758852aa9ba2866348e6f973da3447b3623 100644 (file)
--- a/drivers/tee/tee_core.c
+++ b/drivers/tee/tee_core.c
@@ -238,6 +238,17 @@ static int params_from_user(struct tee_context *ctx, struct tee_param *params,
                        if (IS_ERR(shm))
                                return PTR_ERR(shm);
 
+                       /*
+                        * Ensure offset + size does not overflow offset
+                        * and does not overflow the size of the referred
+                        * shared memory object.
+                        */
+                       if ((ip.a + ip.b) < ip.a ||
+                           (ip.a + ip.b) > shm->size) {
+                               tee_shm_put(shm);
+                               return -EINVAL;
+                       }
+
                        params[n].u.memref.shm_offs = ip.a;
                        params[n].u.memref.size = ip.b;
                        params[n].u.memref.shm = shm;

diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
index 556960a1bab3b4631b10a2803ab54167b06c376b..07d3be6f0780db209ac2be07354ac390c31d6be8 100644 (file)
--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -360,9 +360,10 @@ int tee_shm_get_fd(struct tee_shm *shm)
        if (!(shm->flags & TEE_SHM_DMA_BUF))
                return -EINVAL;
 
+       get_dma_buf(shm->dmabuf);
        fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC);
-       if (fd >= 0)
-               get_dma_buf(shm->dmabuf);
+       if (fd < 0)
+               dma_buf_put(shm->dmabuf);
        return fd;
 }