Re: [Tee-dev] [PATCH] tee: shm: fix use-after-free via temporarily dropped reference

Hi Jens,

On 7 May 2018 at 12:58, Jens Wiklander jens.wiklander@linaro.org wrote:

From: Jann Horn jannh@google.com

Bump the file's refcount before moving the reference into the fd table, not afterwards. The old code could drop the file's refcount to zero for a short moment before calling get_file() via get_dma_buf().

This code can only be triggered on ARM systems that use Linaro's OP-TEE.

Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem") Signed-off-by: Jann Horn jannh@google.com Signed-off-by: Jens Wiklander jens.wiklander@linaro.org

Reviewed-by: Volodymyr Babchuk vlad.babchuk@gmail.com