diff options
| author | Jann Horn <[email protected]> | 2018-04-04 21:03:21 +0200 |
|---|---|---|
| committer | Jens Wiklander <[email protected]> | 2018-05-07 11:50:25 +0200 |
| commit | bb765d1c331f62b59049d35607ed2e365802bef9 (patch) | |
| tree | 08178bf9dce45a1fd175e1a6cf65f58b91d6f0b8 /drivers/fpga/fpga-bridge.c | |
| parent | 75bc37fefc4471e718ba8e651aa74673d4e0a9eb (diff) | |
tee: shm: fix use-after-free via temporarily dropped reference
Bump the file's refcount before moving the reference into the fd table,
not afterwards. The old code could drop the file's refcount to zero for a
short moment before calling get_file() via get_dma_buf().
This code can only be triggered on ARM systems that use Linaro's OP-TEE.
Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem")
Signed-off-by: Jann Horn <[email protected]>
Signed-off-by: Jens Wiklander <[email protected]>
Diffstat (limited to 'drivers/fpga/fpga-bridge.c')
0 files changed, 0 insertions, 0 deletions