Skip to content
Commit bb765d1c authored by Jann Horn's avatar Jann Horn Committed by Jens Wiklander
Browse files

tee: shm: fix use-after-free via temporarily dropped reference



Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().

This code can only be triggered on ARM systems that use Linaro's OP-TEE.

Fixes: 967c9cca ("tee: generic TEE subsystem")
Signed-off-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarJens Wiklander <jens.wiklander@linaro.org>
parent 75bc37fe
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment