)]}'
{
  "commit": "c05d8f66ec3470e5212c4d08c46d6cb5738d600d",
  "tree": "8df47dbd133d385949c408b8d3895431470e68f1",
  "parents": [
    "0ffb9f83e4f6e6a8b68f926173a8d0646b57bedf"
  ],
  "author": {
    "name": "Jens Wiklander",
    "email": "jens.wiklander@linaro.org",
    "time": "Thu Dec 09 15:59:37 2021 +0100"
  },
  "committer": {
    "name": "Greg Kroah-Hartman",
    "email": "gregkh@linuxfoundation.org",
    "time": "Wed Dec 29 12:26:02 2021 +0100"
  },
  "message": "tee: handle lookup of shm with reference count 0\n\ncommit dfd0743f1d9ea76931510ed150334d571fbab49d upstream.\n\nSince the tee subsystem does not keep a strong reference to its idle\nshared memory buffers, it races with other threads that try to destroy a\nshared memory through a close of its dma-buf fd or by unmapping the\nmemory.\n\nIn tee_shm_get_from_id() when a lookup in teedev-\u003eidr has been\nsuccessful, it is possible that the tee_shm is in the dma-buf teardown\npath, but that path is blocked by the teedev mutex. Since we don\u0027t have\nan API to tell if the tee_shm is in the dma-buf teardown path or not we\nmust find another way of detecting this condition.\n\nFix this by doing the reference counting directly on the tee_shm using a\nnew refcount_t refcount field. dma-buf is replaced by using\nanon_inode_getfd() instead, this separates the life-cycle of the\nunderlying file from the tee_shm. tee_shm_put() is updated to hold the\nmutex when decreasing the refcount to 0 and then remove the tee_shm from\nteedev-\u003eidr before releasing the mutex. This means that the tee_shm can\nnever be found unless it has a refcount larger than 0.\n\nFixes: 967c9cca2cc5 (\"tee: generic TEE subsystem\")\nCc: stable@vger.kernel.org\nReviewed-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nReviewed-by: Lars Persson \u003clarper@axis.com\u003e\nReviewed-by: Sumit Garg \u003csumit.garg@linaro.org\u003e\nReported-by: Patrik Lantz \u003cpatrik.lantz@axis.com\u003e\nSigned-off-by: Jens Wiklander \u003cjens.wiklander@linaro.org\u003e\nSigned-off-by: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "8a9384a64f3e2914336209914c9026acd9fea3de",
      "old_mode": 33188,
      "old_path": "drivers/tee/tee_shm.c",
      "new_id": "499fccba3d74bd5471eea8aa609811c00ea17029",
      "new_mode": 33188,
      "new_path": "drivers/tee/tee_shm.c"
    },
    {
      "type": "modify",
      "old_id": "459e9a76d7e6ff39b37e7bf50353140ad8ef3742",
      "old_mode": 33188,
      "old_path": "include/linux/tee_drv.h",
      "new_id": "0c6c1de6f3b7782c833090aed78a28b4efdf7c3f",
      "new_mode": 33188,
      "new_path": "include/linux/tee_drv.h"
    }
  ]
}