kernel/linux.git/drivers/tee/tee_shm.c, branch linux-4.16.y

tee: shm: fix use-after-free via temporarily dropped reference

2018-05-22T16:56:21+00:00

commit bb765d1c331f62b59049d35607ed2e365802bef9 upstream. Bump the file's refcount before moving the reference into the fd table, not afterwards. The old code could drop the file's refcount to zero for a short moment before calling get_file() via get_dma_buf(). This code can only be triggered on ARM systems that use Linaro's OP-TEE. Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem") Signed-off-by: Jann Horn Signed-off-by: Jens Wiklander Signed-off-by: Greg Kroah-Hartman

tee: shm: Potential NULL dereference calling tee_shm_register()

2018-01-09T13:34:00+00:00

get_user_pages_fast() can return zero in certain error paths. We should handle that or else it means we accidentally return ERR_PTR(0) which is NULL instead of an error pointer. The callers are not expecting that and will crash with a NULL dereference. Fixes: 033ddf12bcf5 ("tee: add register user memory") Signed-off-by: Dan Carpenter Signed-off-by: Jens Wiklander

tee: shm: don't put_page on null shm->pages

2017-12-28T21:20:10+00:00

In the case that shm->pages fails to allocate, the current exit error path will try to put_page on a null shm->pages and cause a null pointer dereference when accessing shm->pages[n]. Fix this by only performing the put_page and kfree on shm->pages if it is not null. Detected by CoverityScan, CID#1463283 ("Dereference after null check") Fixes: 033ddf12bcf5 ("tee: add register user memory") Signed-off-by: Colin Ian King Signed-off-by: Jens Wiklander

tee: shm: make function __tee_shm_alloc static

2017-12-28T21:19:57+00:00

The function __tee_shm_alloc is local to the source and does not need to be in global scope, so make it static. Cleans up sparse warning: symbol '__tee_shm_alloc' was not declared. Should it be static? Signed-off-by: Colin Ian King Signed-off-by: Jens Wiklander

tee: add start argument to shm_register callback

2017-12-28T09:08:00+00:00

Adds a start argument to the shm_register callback to allow the callback to check memory type of the passed pages. Signed-off-by: Jens Wiklander

tee: shm: inline tee_shm_get_id()

2017-12-15T12:36:21+00:00

Now, when struct tee_shm is defined in public header, we can inline small getter functions like this one. Signed-off-by: Volodymyr Babchuk Signed-off-by: Jens Wiklander

tee: use reference counting for tee_context

2017-12-15T12:36:18+00:00

We need to ensure that tee_context is present until last shared buffer will be freed. Signed-off-by: Volodymyr Babchuk Signed-off-by: Jens Wiklander

tee: add register user memory

2017-12-15T12:32:20+00:00

Added new ioctl to allow users register own buffers as a shared memory. Signed-off-by: Volodymyr Babchuk [jw: moved tee_shm_is_registered() declaration] [jw: added space after __tee_shm_alloc() implementation] Signed-off-by: Jens Wiklander

tee: flexible shared memory pool creation

2017-12-15T11:37:29+00:00

Makes creation of shm pools more flexible by adding new more primitive functions to allocate a shm pool. This makes it easier to add driver specific shm pool management. Signed-off-by: Jens Wiklander Signed-off-by: Volodymyr Babchuk

tee: tee_shm: Constify dma_buf_ops structures.

2017-08-04T08:30:27+00:00

dma_buf_ops are not supposed to change at runtime. All functions working with dma_buf_ops provided by work with const dma_buf_ops. So mark the non-const structs as const. File size before: text data bss dec hex filename 2026 112 0 2138 85a drivers/tee/tee_shm.o File size After adding 'const': text data bss dec hex filename 2138 0 0 2138 85a drivers/tee/tee_shm.o Signed-off-by: Arvind Yadav Signed-off-by: Jens Wiklander