diff options
| author | Georgiy Osokin <g.osokin@auroraos.dev> | 2026-04-08 18:52:03 +0300 |
|---|---|---|
| committer | Jens Wiklander <jens.wiklander@linaro.org> | 2026-05-20 08:49:09 +0200 |
| commit | 26682f5efc276e3ad96d102019472bfbf03833b2 (patch) | |
| tree | 92701fa7809249e41fa9f5cc6c43aee913152a2c | |
| parent | c15d7a2a11ea055bcecc0b538ae8ba79475637f9 (diff) | |
tee: shm: fix shm leak in register_shm_helper()
register_shm_helper() allocates shm before calling
iov_iter_npages(). If iov_iter_npages() returns 0, the function
jumps to err_ctx_put and leaks shm.
This can be triggered by TEE_IOC_SHM_REGISTER with
struct tee_ioctl_shm_register_data where length is 0.
Jump to err_free_shm instead.
Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
Cc: stable@vger.kernel.org
Cc: lvc-project@linuxtesting.org
Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
| -rw-r--r-- | drivers/tee/tee_shm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index e9ea9f80cfd9..6742b3579c86 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -435,7 +435,7 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags, num_pages = iov_iter_npages(iter, INT_MAX); if (!num_pages) { ret = ERR_PTR(-ENOMEM); - goto err_ctx_put; + goto err_free_shm; } shm->pages = kzalloc_objs(*shm->pages, num_pages); |