diff options
| author | Olof Johansson <olof@lixom.net> | 2018-05-14 01:02:11 -0700 |
|---|---|---|
| committer | Olof Johansson <olof@lixom.net> | 2018-05-14 01:02:11 -0700 |
| commit | c1c6fe6c66c193023865a312af06df5216b82ac8 (patch) | |
| tree | 974b5d602b68b9fa9302d42a7ddfd0716c682acf | |
| parent | 0d463d8449010347b2bd8723cf32298bd07cfc57 (diff) | |
| parent | ab9d3db5b320a052452b9cd035599ee3c84bbee9 (diff) | |
| download | linux-c1c6fe6c66c193023865a312af06df5216b82ac8.tar.bz2 | |
Merge tag 'tee-drv-fixes-for-4.17' of git://git.linaro.org/people/jens.wiklander/linux-tee into fixes
Small fixes for tee subsystem
* Fixes for use-after-free via temporarily dropped reference
* Checks that passed shm references are consistent in offset/size
with regards to the shm object
* tag 'tee-drv-fixes-for-4.17' of git://git.linaro.org/people/jens.wiklander/linux-tee:
tee: check shm references are consistent in offset/size
tee: shm: fix use-after-free via temporarily dropped reference
Signed-off-by: Olof Johansson <olof@lixom.net>
| -rw-r--r-- | drivers/tee/tee_core.c | 11 | ||||
| -rw-r--r-- | drivers/tee/tee_shm.c | 5 |
2 files changed, 14 insertions, 2 deletions
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c index 0124a91c8d71..dd46b758852a 100644 --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -238,6 +238,17 @@ static int params_from_user(struct tee_context *ctx, struct tee_param *params, if (IS_ERR(shm)) return PTR_ERR(shm); + /* + * Ensure offset + size does not overflow offset + * and does not overflow the size of the referred + * shared memory object. + */ + if ((ip.a + ip.b) < ip.a || + (ip.a + ip.b) > shm->size) { + tee_shm_put(shm); + return -EINVAL; + } + params[n].u.memref.shm_offs = ip.a; params[n].u.memref.size = ip.b; params[n].u.memref.shm = shm; diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 556960a1bab3..07d3be6f0780 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -360,9 +360,10 @@ int tee_shm_get_fd(struct tee_shm *shm) if (!(shm->flags & TEE_SHM_DMA_BUF)) return -EINVAL; + get_dma_buf(shm->dmabuf); fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC); - if (fd >= 0) - get_dma_buf(shm->dmabuf); + if (fd < 0) + dma_buf_put(shm->dmabuf); return fd; } |