search

OP-TEE / optee_os

Trusted side of the TEE
Other
1.59k stars 1.07k forks source link

core: fix race in mobj_reg_shm_get_by_cookie() #7095

Closed jenswi-linaro closed 1 week ago

jenswi-linaro commented 2 weeks ago

Until this patch in mobj_reg_shm_get_by_cookie() there's a small window after cpu_spin_unlock_xrestore() before the reference counter is increased with mobj_get(). Fix that by calling mobj_get() before unlocking reg_shm_slist_lock.

Fixes: b96514926b8e ("core: reference count struct mobj")

jenswi-linaro commented 2 weeks ago

Tag applied.