Skip to content

L
linux
Switch branch/tag
  1. 17 Dec, 2021 2 commits
  3. 16 Dec, 2021 3 commits
    • Xiaolei Wang's avatar
      optee: Suppress false positive kmemleak report in optee_handle_rpc() · 6add87fd
      Xiaolei Wang authored 
      We observed the following kmemleak report:
unreferenced object 0xffff000007904500 (size 128):
  comm "swapper/0", pid 1, jiffies 4294892671 (age 44.036s)
  hex dump (first 32 bytes):
    00 47 90 07 00 00 ff ff 60 00 c0 ff 00 00 00 00  .G......`.......
    60 00 80 13 00 80 ff ff a0 00 00 00 00 00 00 00  `...............
  backtrace:
    [<000000004c12b1c7>] kmem_cache_alloc+0x1ac/0x2f4
    [<000000005d23eb4f>] tee_shm_alloc+0x78/0x230
    [<00000000794dd22c>] optee_handle_rpc+0x60/0x6f0
    [<00000000d9f7c52d>] optee_do_call_with_arg+0x17c/0x1dc
    [<00000000c35884da>] optee_open_session+0x128/0x1ec
    [<000000001748f2ff>] tee_client_open_session+0x28/0x40
    [<00000000aecb5389>] optee_enumerate_devices+0x84/0x2a0
    [<000000003df18bf1>] optee_probe+0x674/0x6cc
    [<000000003a4a534a>] platform_drv_probe+0x54/0xb0
    [<000000000c51ce7d>] really_probe+0xe4/0x4d0
    [<000000002f04c865>] driver_probe_device+0x58/0xc0
    [<00000000b485397d>] device_driver_attach+0xc0/0xd0
    [<00000000c835f0df>] __driver_attach+0x84/0x124
    [<000000008e5a429c>] bus_for_each_dev+0x70/0xc0
    [<000000001735e8a8>] driver_attach+0x24/0x30
    [<000000006d94b04f>] bus_add_driver+0x104/0x1ec

This is not a memory leak because we pass the share memory pointer
to secure world and would get it from secure world before releasing it.
Signed-off-by: default avatarXiaolei Wang <xiaolei.wang@windriver.com>
Signed-off-by: default avatarJens Wiklander <jens.wiklander@linaro.org>
      6add87fd
    • Sumit Garg's avatar
      tee: optee: Fix incorrect page free bug · 18549bf4
      Sumit Garg authored 
      Pointer to the allocated pages (struct page *page) has already
progressed towards the end of allocation. It is incorrect to perform
__free_pages(page, order) using this pointer as we would free any
arbitrary pages. Fix this by stop modifying the page pointer.

Fixes: ec185dd3 ("optee: Fix memory leak when failing to register shm pages")
Cc: stable@vger.kernel.org
Reported-by: default avatarPatrik Lantz <patrik.lantz@axis.com>
Signed-off-by: default avatarSumit Garg <sumit.garg@linaro.org>
Reviewed-by: default avatarTyler Hicks <tyhicks@linux.microsoft.com>
Signed-off-by: default avatarJens Wiklander <jens.wiklander@linaro.org>
      18549bf4
    • Jens Wiklander's avatar
      tee: handle lookup of shm with reference count 0 · dfd0743f
      Jens Wiklander authored 
      Since the tee subsystem does not keep a strong reference to its idle
shared memory buffers, it races with other threads that try to destroy a
shared memory through a close of its dma-buf fd or by unmapping the
memory.

In tee_shm_get_from_id() when a lookup in teedev->idr has been
successful, it is possible that the tee_shm is in the dma-buf teardown
path, but that path is blocked by the teedev mutex. Since we don't have
an API to tell if the tee_shm is in the dma-buf teardown path or not we
must find another way of detecting this condition.

Fix this by doing the reference counting directly on the tee_shm using a
new refcount_t refcount field. dma-buf is replaced by using
anon_inode_getfd() instead, this separates the life-cycle of the
underlying file from the tee_shm. tee_shm_put() is updated to hold the
mutex when decreasing the refcount to 0 and then remove the tee_shm from
teedev->idr before releasing the mutex. This means that the tee_shm can
never be found unless it has a refcount larger than 0.

Fixes: 967c9cca ("tee: generic TEE subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: default avatarLars Persson <larper@axis.com>
Reviewed-by: default avatarSumit Garg <sumit.garg@linaro.org>
Reported-by: default avatarPatrik Lantz <patrik.lantz@axis.com>
Signed-off-by: default avatarJens Wiklander <jens.wiklander@linaro.org>
      dfd0743f
  5. 12 Dec, 2021 14 commits
  7. 11 Dec, 2021 21 commits
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7