tree 08178bf9dce45a1fd175e1a6cf65f58b91d6f0b8
parent 75bc37fefc4471e718ba8e651aa74673d4e0a9eb
author Jann Horn <jannh@google.com> 1522868601 +0200
committer Jens Wiklander <jens.wiklander@linaro.org> 1525686625 +0200

tee: shm: fix use-after-free via temporarily dropped reference

Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().

This code can only be triggered on ARM systems that use Linaro's OP-TEE.

Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>