superrob1500
/
mirror-linux
mirror of https://github.com/torvalds/linux
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

tee: shm: fix shm leak in register_shm_helper() 

register_shm_helper() allocates shm before calling
iov_iter_npages(). If iov_iter_npages() returns 0, the function
jumps to err_ctx_put and leaks shm.

This can be triggered by TEE_IOC_SHM_REGISTER with
struct tee_ioctl_shm_register_data where length is 0.

Jump to err_free_shm instead.

Fixes: 7bdee41575 ("tee: Use iov_iter to better support shared buffer registration")
Cc: stable@vger.kernel.org
Cc: lvc-project@linuxtesting.org
Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
master^2
Georgiy Osokin 2026-04-08 18:52:03 +03:00 committed by Jens Wiklander
parent c15d7a2a11
commit 26682f5efc
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/tee/tee_shm.c
View File

@ -435,7 +435,7 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
num_pages = iov_iter_npages(iter, INT_MAX); num_pages = iov_iter_npages(iter, INT_MAX);
if (!num_pages) { if (!num_pages) {
ret = ERR_PTR(-ENOMEM); ret = ERR_PTR(-ENOMEM);
goto err_ctx_put; goto err_free_shm;
} }
shm->pages = kzalloc_objs(*shm->pages, num_pages); shm->pages = kzalloc_objs(*shm->pages, num_pages);