* [PATCH] tee: avoid accessing dma-buf shared memory after put
@ 2026-08-06 6:07 Hongyan Xu
2026-11-05 12:56 ` Jens Wiklander
0 siblings, 1 reply; 3+ messages in thread
From: Hongyan Xu @ 2026-08-06 6:07 UTC (permalink / raw)
To: Jens Wiklander
Cc: Sumit Garg, Olivier Masse, Etienne Carriere, op-tee,
linux-kernel, stable, jianhao.xu, Hongyan Xu
param_from_user_memref() obtains a temporary reference to the dma-buf
tee_shm wrapper by ID. If closing the shared-memory file descriptor races
with the ioctl, this temporary reference can be the wrapper's last one.
tee_shm_put() then frees the enclosing tee_shm_dmabuf_ref, but the function
still reads ref->parent_shm and ref->offset afterwards.
Save the parent pointer and offset before dropping the wrapper reference.
The additional parent reference keeps the parent shared memory alive for
the parameter list as before.
Fixes: 146bf4e75eca ("tee: new ioctl to a register tee_shm from a dmabuf file descriptor")
Cc: stable@vger.kernel.org
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
drivers/tee/tee_core.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
index 1aac50c7c1de..489c39d5b35f 100644
--- a/drivers/tee/tee_core.c
+++ b/drivers/tee/tee_core.c
@@ -397,6 +397,7 @@ static int param_from_user_memref(struct tee_context *ctx,
}
if (shm->flags & TEE_SHM_DMA_BUF) {
+ struct tee_shm *parent_shm;
struct tee_shm_dmabuf_ref *ref;
ref = container_of(shm, struct tee_shm_dmabuf_ref, shm);
@@ -409,10 +410,11 @@ static int param_from_user_memref(struct tee_context *ctx,
* list instead of the shm we got with
* tee_shm_get_from_id() above.
*/
- refcount_inc(&ref->parent_shm->refcount);
- tee_shm_put(shm);
- shm = ref->parent_shm;
+ parent_shm = ref->parent_shm;
offs = ref->offset;
+ refcount_inc(&parent_shm->refcount);
+ tee_shm_put(shm);
+ shm = parent_shm;
}
}
} else if (ctx->cap_memref_null) {
--
2.50.1.windows.1
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] tee: avoid accessing dma-buf shared memory after put
2026-08-06 6:07 [PATCH] tee: avoid accessing dma-buf shared memory after put Hongyan Xu
@ 2026-11-05 12:56 ` Jens Wiklander
2026-11-09 6:27 ` Sumit Garg
0 siblings, 1 reply; 3+ messages in thread
From: Jens Wiklander @ 2026-11-05 12:56 UTC (permalink / raw)
To: Hongyan Xu
Cc: Jens Wiklander, Sumit Garg, Olivier Masse, Etienne Carriere,
op-tee, linux-kernel, stable, jianhao.xu
Hi,
On Thu, Aug 6, 2026 at 8:07 AM Hongyan Xu <getshell@seu.edu.cn> wrote:
>
> param_from_user_memref() obtains a temporary reference to the dma-buf
> tee_shm wrapper by ID. If closing the shared-memory file descriptor races
> with the ioctl, this temporary reference can be the wrapper's last one.
> tee_shm_put() then frees the enclosing tee_shm_dmabuf_ref, but the function
> still reads ref->parent_shm and ref->offset afterwards.
>
> Save the parent pointer and offset before dropping the wrapper reference.
> The additional parent reference keeps the parent shared memory alive for
> the parameter list as before.
>
> Fixes: 146bf4e75eca ("tee: new ioctl to a register tee_shm from a dmabuf file descriptor")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
> ---
> drivers/tee/tee_core.c | 8 +++++---
> 1 file changed, 5 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
> index 1aac50c7c1de..489c39d5b35f 100644
> --- a/drivers/tee/tee_core.c
> +++ b/drivers/tee/tee_core.c
> @@ -397,6 +397,7 @@ static int param_from_user_memref(struct tee_context *ctx,
> }
>
> if (shm->flags & TEE_SHM_DMA_BUF) {
> + struct tee_shm *parent_shm;
> struct tee_shm_dmabuf_ref *ref;
>
> ref = container_of(shm, struct tee_shm_dmabuf_ref, shm);
> @@ -409,10 +410,11 @@ static int param_from_user_memref(struct tee_context *ctx,
> * list instead of the shm we got with
> * tee_shm_get_from_id() above.
> */
> - refcount_inc(&ref->parent_shm->refcount);
> - tee_shm_put(shm);
> - shm = ref->parent_shm;
> + parent_shm = ref->parent_shm;
> offs = ref->offset;
> + refcount_inc(&parent_shm->refcount);
> + tee_shm_put(shm);
> + shm = parent_shm;
> }
> }
> } else if (ctx->cap_memref_null) {
> --
> 2.50.1.windows.1
>
Looks good. Sumit, do you agree?
Cheers,
Jens
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] tee: avoid accessing dma-buf shared memory after put
2026-11-05 12:56 ` Jens Wiklander
@ 2026-11-09 6:27 ` Sumit Garg
0 siblings, 0 replies; 3+ messages in thread
From: Sumit Garg @ 2026-11-09 6:27 UTC (permalink / raw)
To: Jens Wiklander
Cc: Hongyan Xu, Jens Wiklander, Sumit Garg, Olivier Masse,
Etienne Carriere, op-tee, linux-kernel, stable, jianhao.xu
On Thu, 05 Nov 2026 at 13:56:51 +0100, Jens Wiklander wrote:
>Hi,
>
>On Thu, Aug 6, 2026 at 8:07 AM Hongyan Xu <getshell@seu.edu.cn> wrote:
>>
>> param_from_user_memref() obtains a temporary reference to the dma-buf
>> tee_shm wrapper by ID. If closing the shared-memory file descriptor races
>> with the ioctl, this temporary reference can be the wrapper's last one.
>> tee_shm_put() then frees the enclosing tee_shm_dmabuf_ref, but the function
>> still reads ref->parent_shm and ref->offset afterwards.
>>
>> Save the parent pointer and offset before dropping the wrapper reference.
>> The additional parent reference keeps the parent shared memory alive for
>> the parameter list as before.
>>
>> Fixes: 146bf4e75eca ("tee: new ioctl to a register tee_shm from a dmabuf file descriptor")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
>> ---
>> drivers/tee/tee_core.c | 8 +++++---
>> 1 file changed, 5 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
>> index 1aac50c7c1de..489c39d5b35f 100644
>> --- a/drivers/tee/tee_core.c
>> +++ b/drivers/tee/tee_core.c
>> @@ -397,6 +397,7 @@ static int param_from_user_memref(struct tee_context *ctx,
>> }
>>
>> if (shm->flags & TEE_SHM_DMA_BUF) {
>> + struct tee_shm *parent_shm;
>> struct tee_shm_dmabuf_ref *ref;
>>
>> ref = container_of(shm, struct tee_shm_dmabuf_ref, shm);
>> @@ -409,10 +410,11 @@ static int param_from_user_memref(struct tee_context *ctx,
>> * list instead of the shm we got with
>> * tee_shm_get_from_id() above.
>> */
>> - refcount_inc(&ref->parent_shm->refcount);
>> - tee_shm_put(shm);
>> - shm = ref->parent_shm;
>> + parent_shm = ref->parent_shm;
>> offs = ref->offset;
>> + refcount_inc(&parent_shm->refcount);
>> + tee_shm_put(shm);
>> + shm = parent_shm;
>> }
>> }
>> } else if (ctx->cap_memref_null) {
>> --
>> 2.50.1.windows.1
>>
>
>Looks good. Sumit, do you agree?
>
Sounds reasonable to me, FWIW:
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
-Sumit
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-11-09 6:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-06 6:07 [PATCH] tee: avoid accessing dma-buf shared memory after put Hongyan Xu
2026-11-05 12:56 ` Jens Wiklander
2026-11-09 6:27 ` Sumit Garg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®