[PATCH] firmware: arm_scmi: optee: Check return value of tee_shm_get_va()

[PATCH] firmware: arm_scmi: optee: Check return value of tee_shm_get_va()

[Chen Ni]

The function tee_shm_get_va() can return an error pointer if the shared
memory is not properly mapped or if the offset is invalid. Without this
check, passing the error pointer to subsequent memory operations could
lead to a kernel panic.

Add a check for IS_ERR() on the return value of tee_shm_get_va().

Fixes: db9cc5e67778 ("firmware: arm_scmi: Make OPTEE transport a standalone driver")
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
---
 drivers/firmware/arm_scmi/transports/optee.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/firmware/arm_scmi/transports/optee.c b/drivers/firmware/arm_scmi/transports/optee.c
index 07ae18d5279d..a6774152c205 100644
--- a/drivers/firmware/arm_scmi/transports/optee.c
+++ b/drivers/firmware/arm_scmi/transports/optee.c
@@ -340,6 +340,13 @@ static int setup_dynamic_shmem(struct device *dev, struct scmi_optee_channel *ch
 	}
 
 	shbuf = tee_shm_get_va(channel->tee_shm, 0);
+	if (IS_ERR(shbuf)) {
+		dev_err(channel->cinfo->dev, "failed to get shared memory VA\n");
+		tee_shm_free(channel->tee_shm);
+		channel->tee_shm = NULL;
+		return PTR_ERR(shbuf);
+	}
+
 	memset(shbuf, 0, msg_size);
 	channel->req.msg = shbuf;
 	channel->rx_len = msg_size;
-- 
2.25.1

Re: [PATCH] firmware: arm_scmi: optee: Check return value of tee_shm_get_va()

[Dan Carpenter]

On Thu, Mar 05, 2026 at 03:15:33PM +0800, Chen Ni wrote:
> The function tee_shm_get_va() can return an error pointer if the shared
> memory is not properly mapped or if the offset is invalid.

The memory is properly mapped though.  We just allocated it on the
previous line.  The offset is zero and the size is
SCMI_SHMEM_MAX_PAYLOAD_SIZE so that's fine too.

There is no need for an IS_ERR() check.

regards,
dan carpenter