Files
kernel_google_b4s4/include/linux
Jens Wiklander 4c34a4e473 BACKPORT: tee: handle lookup of shm with reference count 0
commit dfd0743f1d9ea76931510ed150334d571fbab49d upstream.

Since the tee subsystem does not keep a strong reference to its idle
shared memory buffers, it races with other threads that try to destroy a
shared memory through a close of its dma-buf fd or by unmapping the
memory.

In tee_shm_get_from_id() when a lookup in teedev->idr has been
successful, it is possible that the tee_shm is in the dma-buf teardown
path, but that path is blocked by the teedev mutex. Since we don't have
an API to tell if the tee_shm is in the dma-buf teardown path or not we
must find another way of detecting this condition.

Fix this by doing the reference counting directly on the tee_shm using a
new refcount_t refcount field. dma-buf is replaced by using
anon_inode_getfd() instead, this separates the life-cycle of the
underlying file from the tee_shm. tee_shm_put() is updated to hold the
mutex when decreasing the refcount to 0 and then remove the tee_shm from
teedev->idr before releasing the mutex. This means that the tee_shm can
never be found unless it has a refcount larger than 0.

Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Lars Persson <larper@axis.com>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Reported-by: Patrik Lantz <patrik.lantz@axis.com>
[JW: backport to 5.4-stable]
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Lee Jones <lee.jones@linaro.org>
[mkbestas: backport to 4.9]
Signed-off-by: Michael Bestas <mkbestas@lineageos.org>
Change-Id: Ibd2809a225b167563c65faff4a44e56e23c2e97b
2025-06-18 10:14:18 +02:00
..
2022-10-26 13:15:43 +02:00
2020-05-13 19:01:51 +00:00
2022-08-25 12:09:51 +02:00
2022-01-11 15:21:18 +01:00
2022-06-16 13:05:12 +02:00
2018-02-28 10:18:33 +01:00
2018-04-11 13:28:37 -07:00
2017-11-27 18:17:03 -08:00
2017-12-10 17:14:07 +01:00
2020-01-21 11:28:26 -08:00
2023-04-09 11:25:03 +03:00
2020-05-13 19:01:51 +00:00
2018-04-26 21:50:58 +00:00
2021-02-23 14:46:12 +01:00
2021-02-03 23:19:50 +01:00
2018-11-14 10:02:11 +00:00
2021-12-14 10:35:14 +01:00
2021-03-30 14:41:41 +02:00
2019-08-11 15:30:44 +02:00
2018-10-10 08:53:18 +02:00
2019-05-08 07:46:34 +02:00
2017-11-27 18:16:28 -08:00
2021-11-26 11:48:18 +01:00
2022-07-29 18:58:19 +02:00
2023-01-15 16:23:04 +02:00
2023-06-20 14:47:12 +03:00
2020-10-06 16:40:47 -07:00
2019-11-14 14:28:42 +08:00
2021-07-11 12:46:40 +02:00
2020-10-29 10:17:40 +01:00
2019-11-14 14:28:42 +08:00
2023-06-20 14:47:12 +03:00
2020-03-20 09:07:43 +01:00
2019-09-03 13:45:29 -07:00
2018-12-17 20:00:56 +00:00
2022-07-29 18:58:19 +02:00
2020-04-02 17:20:39 +02:00
2022-09-28 11:12:52 +02:00
2023-06-20 14:47:12 +03:00
2023-06-20 14:47:12 +03:00
2019-09-03 13:45:40 -07:00
2021-03-07 11:40:25 +01:00
2018-11-13 11:17:02 -08:00
2022-10-26 13:28:31 +02:00
2021-03-24 11:32:14 +01:00
2020-12-11 13:38:00 +01:00
2022-06-25 11:45:10 +02:00
2018-09-10 09:20:19 +02:00
2020-04-02 17:20:39 +02:00
2021-12-14 10:04:48 +01:00
2018-08-23 12:05:06 -07:00
2021-03-07 11:40:25 +01:00
2018-08-23 12:05:06 -07:00