kernel/drivers/tee/tee_shm.c, branch linux-5.1.y

Merge tag 'drm-misc-next-2018-06-21' of git://anongit.freedesktop.org/drm/drm-misc into drm-next

2018-06-22T02:58:08Z

drm-misc-next for 4.19: UAPI Changes: - Add writeback connector (Brian Starkey/Liviu Dudau) - Add "content type" property to HDMI connectors (Stanislav Lisovskiy) Cross-subsystem Changes: - some devicetree Docs update - fix compile breakage on ION due to the dma-buf cleanups (Christian König) Core Changes: - Reject over-sized allocation requests early (Chris Wilson) - gem-fb-helper: Always do implicit sync (Daniel Vetter) - dma-buf cleanups (Christian König) Driver Changes: - Fixes for the otm8009a panel driver (Philippe Cornu) - Add Innolux TV123WAM panel driver support (Sandeep Panda) - Move GEM BO to drm_framebuffer in few drivers (Daniel Stone) - i915 pinning improvements (Chris Wilson) - Stop consulting plane->fb/crtc in a few drivers (Ville Syrjälä) Signed-off-by: Dave Airlie Link: https://patchwork.freedesktop.org/patch/msgid/20180621105428.GA20795@juma

dma-buf: remove kmap_atomic interface

2018-06-20T13:59:34Z

Neither used nor correctly implemented anywhere. Just completely remove the interface. Signed-off-by: Christian König Reviewed-by: Daniel Vetter Acked-by: Sumit Semwal Link: https://patchwork.freedesktop.org/patch/226645/

tee: shm: fix use-after-free via temporarily dropped reference

2018-05-07T09:50:25Z

Bump the file's refcount before moving the reference into the fd table, not afterwards. The old code could drop the file's refcount to zero for a short moment before calling get_file() via get_dma_buf(). This code can only be triggered on ARM systems that use Linaro's OP-TEE. Fixes: 967c9cca2cc5 ("tee: generic TEE subsystem") Signed-off-by: Jann Horn Signed-off-by: Jens Wiklander

tee: shm: Potential NULL dereference calling tee_shm_register()

2018-01-09T13:34:00Z

get_user_pages_fast() can return zero in certain error paths. We should handle that or else it means we accidentally return ERR_PTR(0) which is NULL instead of an error pointer. The callers are not expecting that and will crash with a NULL dereference. Fixes: 033ddf12bcf5 ("tee: add register user memory") Signed-off-by: Dan Carpenter Signed-off-by: Jens Wiklander

tee: shm: don't put_page on null shm->pages

2017-12-28T21:20:10Z

In the case that shm->pages fails to allocate, the current exit error path will try to put_page on a null shm->pages and cause a null pointer dereference when accessing shm->pages[n]. Fix this by only performing the put_page and kfree on shm->pages if it is not null. Detected by CoverityScan, CID#1463283 ("Dereference after null check") Fixes: 033ddf12bcf5 ("tee: add register user memory") Signed-off-by: Colin Ian King Signed-off-by: Jens Wiklander

tee: shm: make function __tee_shm_alloc static

2017-12-28T21:19:57Z

The function __tee_shm_alloc is local to the source and does not need to be in global scope, so make it static. Cleans up sparse warning: symbol '__tee_shm_alloc' was not declared. Should it be static? Signed-off-by: Colin Ian King Signed-off-by: Jens Wiklander

tee: add start argument to shm_register callback

2017-12-28T09:08:00Z

Adds a start argument to the shm_register callback to allow the callback to check memory type of the passed pages. Signed-off-by: Jens Wiklander

tee: shm: inline tee_shm_get_id()

2017-12-15T12:36:21Z

Now, when struct tee_shm is defined in public header, we can inline small getter functions like this one. Signed-off-by: Volodymyr Babchuk Signed-off-by: Jens Wiklander

tee: use reference counting for tee_context

2017-12-15T12:36:18Z

We need to ensure that tee_context is present until last shared buffer will be freed. Signed-off-by: Volodymyr Babchuk Signed-off-by: Jens Wiklander

tee: add register user memory

2017-12-15T12:32:20Z

Added new ioctl to allow users register own buffers as a shared memory. Signed-off-by: Volodymyr Babchuk [jw: moved tee_shm_is_registered() declaration] [jw: added space after __tee_shm_alloc() implementation] Signed-off-by: Jens Wiklander