diff options
| author | Jann Horn <jannh@google.com> | 2018-04-04 21:03:21 +0200 |
|---|---|---|
| committer | Jens Wiklander <jens.wiklander@linaro.org> | 2018-05-07 11:50:25 +0200 |
| commit | bb765d1c331f62b59049d35607ed2e365802bef9 (patch) | |
| tree | 08178bf9dce45a1fd175e1a6cf65f58b91d6f0b8 /arch/m68k | |
| parent | 75bc37fefc4471e718ba8e651aa74673d4e0a9eb (diff) | |
| download | lwn-bb765d1c331f62b59049d35607ed2e365802bef9.tar.gz lwn-bb765d1c331f62b59049d35607ed2e365802bef9.zip | |
tee: shm: fix use-after-free via temporarily dropped reference
Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().
This code can only be triggered on ARM systems that use Linaro's OP-TEE.
Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Diffstat (limited to 'arch/m68k')
0 files changed, 0 insertions, 0 deletions