Skip to content

Commit

Permalink
tee: fix unbalanced context refcount in register shm from fd
Browse files Browse the repository at this point in the history
Successful registration of a memory reference in the scope of a
TEE content must increase the context refcount. This change
adds this missing refcount increase.

The context refcount is already decremented when such shm reference
is freed by its owner, in tee_shm_release(), hence current unbalance
refcount before this path is applied.

Fixes: 9f9806e ("tee: new ioctl to a register tee_shm from a dmabuf file descriptor")

Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>
Tested-by: Etienne Carriere <etienne.carriere@linaro.org> (Qemu armv7/v8)
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
  • Loading branch information
etienne-lms authored and jforissier committed Apr 16, 2018
1 parent 3ed4ce4 commit 94c2f2e
Showing 1 changed file with 3 additions and 0 deletions.
3 changes: 3 additions & 0 deletions drivers/tee/tee_shm.c
Original file line number Diff line number Diff line change
Expand Up @@ -372,6 +372,8 @@ struct tee_shm *tee_shm_register_fd(struct tee_context *ctx, int fd)
if (!tee_device_get(ctx->teedev))
return ERR_PTR(-EINVAL);

teedev_ctx_get(ctx);

ref = kzalloc(sizeof(*ref), GFP_KERNEL);
if (!ref) {
rc = ERR_PTR(-ENOMEM);
Expand Down Expand Up @@ -452,6 +454,7 @@ struct tee_shm *tee_shm_register_fd(struct tee_context *ctx, int fd)
dma_buf_put(ref->dmabuf);
}
kfree(ref);
teedev_ctx_put(ctx);
tee_device_put(ctx->teedev);
return rc;
}
Expand Down

0 comments on commit 94c2f2e

Please sign in to comment.