tee-supplicant: close shm fd before freeing memory
The resources of a shm is released in process_free(), this includes the
file descriptor and the memory buffer which was registered. Closing
the file descriptor unregisters the memory buffer.
The memory buffer was, prior to this patch, freed before the file
descriptor was closed. This could lead to another thread reusing this
memory buffer before it has been unregistered. This is normally not a
problem since the buffer will not be read or modified after it has been
freed. However, FF-A mandates that a physical memory isn't registered
already when registering. Son in the case we can have occasional failures.
Fixes: 075c56eebdc9 ("tee_supplicant: add register memory feature")
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
diff --git a/tee-supplicant/src/tee_supplicant.c b/tee-supplicant/src/tee_supplicant.c
index 53c29a2..e144cb5 100644
--- a/tee-supplicant/src/tee_supplicant.c
+++ b/tee-supplicant/src/tee_supplicant.c
@@ -420,19 +420,18 @@
if (!shm)
return TEEC_ERROR_BAD_PARAMETERS;
+ close(shm->fd);
if (shm->registered) {
free(shm->p);
} else {
if (munmap(shm->p, shm->size) != 0) {
EMSG("munmap(%p, %zu) failed - Error = %s",
shm->p, shm->size, strerror(errno));
- close(shm->fd);
free(shm);
return TEEC_ERROR_BAD_PARAMETERS;
}
}
- close(shm->fd);
free(shm);
return TEEC_SUCCESS;
}