mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-05-10 12:53:04 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge tag 'tee-fixes-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes

Browse Source 
TEE fixes for v6.17

- Fixing a memory leak in the error path for tee_dyn_shm_alloc_helper()
- Fixing a NULL pointer dereference in tee_shm_put()

* tag 'tee-fixes-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
  tee: fix memory leak in tee_dyn_shm_alloc_helper
  tee: fix NULL pointer dereference in tee_shm_put

Link: https://lore.kernel.org/r/20250819122641.GA3486750@rayden
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
This commit is contained in:
Arnd Bergmann
2025-09-01 10:34:33 +02:00
parent e6e709901c 50a74d0095
commit 84bc3c0b58
1 changed files with 10 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/tee/tee_shm.c
View File

@@ -230,7 +230,7 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align,
pages = kcalloc(nr_pages, sizeof(*pages), GFP_KERNEL);
if (!pages) {
rc = -ENOMEM;
goto err;
goto err_pages;
}
for (i = 0; i < nr_pages; i++)
@@ -243,11 +243,13 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align,
rc = shm_register(shm->ctx, shm, pages, nr_pages,
(unsigned long)shm->kaddr);
if (rc)
goto err;
goto err_kfree;
}
return 0;
err:
err_kfree:
kfree(pages);
err_pages:
free_pages_exact(shm->kaddr, shm->size);
shm->kaddr = NULL;
return rc;
@@ -560,9 +562,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id);
*/
void tee_shm_put(struct tee_shm *shm)
{
struct tee_device *teedev = shm->ctx->teedev;
struct tee_device *teedev;
bool do_release = false;
if (!shm || !shm->ctx || !shm->ctx->teedev)
return;
teedev = shm->ctx->teedev;
mutex_lock(&teedev->mutex);
if (refcount_dec_and_test(&shm->refcount)) {
/*