* [PATCH] tee: shm: fix shm leak in register_shm_helper()
@ 2026-04-08 15:52 Georgiy Osokin
2026-04-13 9:03 ` Sumit Garg
0 siblings, 1 reply; 2+ messages in thread
From: Georgiy Osokin @ 2026-04-08 15:52 UTC (permalink / raw)
To: jens.wiklander, op-tee
Cc: sumit.garg, linux-kernel, lvc-project, s.shtylyov, Georgiy Osokin,
stable
register_shm_helper() allocates shm before calling
iov_iter_npages(). If iov_iter_npages() returns 0, the function
jumps to err_ctx_put and leaks shm.
This can be triggered by TEE_IOC_SHM_REGISTER with
struct tee_ioctl_shm_register_data where length is 0.
Jump to err_free_shm instead.
Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
Cc: stable@vger.kernel.org
Cc: lvc-project@linuxtesting.org
Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
---
drivers/tee/tee_shm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
index e9ea9f80cfd9..6742b3579c86 100644
--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -435,7 +435,7 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
num_pages = iov_iter_npages(iter, INT_MAX);
if (!num_pages) {
ret = ERR_PTR(-ENOMEM);
- goto err_ctx_put;
+ goto err_free_shm;
}
shm->pages = kzalloc_objs(*shm->pages, num_pages);
--
2.50.1
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] tee: shm: fix shm leak in register_shm_helper()
2026-04-08 15:52 [PATCH] tee: shm: fix shm leak in register_shm_helper() Georgiy Osokin
@ 2026-04-13 9:03 ` Sumit Garg
0 siblings, 0 replies; 2+ messages in thread
From: Sumit Garg @ 2026-04-13 9:03 UTC (permalink / raw)
To: Georgiy Osokin
Cc: jens.wiklander, op-tee, linux-kernel, lvc-project, s.shtylyov,
stable
On Wed, Apr 08, 2026 at 06:52:03PM +0300, Georgiy Osokin wrote:
> register_shm_helper() allocates shm before calling
> iov_iter_npages(). If iov_iter_npages() returns 0, the function
> jumps to err_ctx_put and leaks shm.
>
> This can be triggered by TEE_IOC_SHM_REGISTER with
> struct tee_ioctl_shm_register_data where length is 0.
>
> Jump to err_free_shm instead.
>
> Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
> Cc: stable@vger.kernel.org
> Cc: lvc-project@linuxtesting.org
> Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
> ---
> drivers/tee/tee_shm.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Thanks for the fix, FWIW:
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
-Sumit
>
> diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
> index e9ea9f80cfd9..6742b3579c86 100644
> --- a/drivers/tee/tee_shm.c
> +++ b/drivers/tee/tee_shm.c
> @@ -435,7 +435,7 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
> num_pages = iov_iter_npages(iter, INT_MAX);
> if (!num_pages) {
> ret = ERR_PTR(-ENOMEM);
> - goto err_ctx_put;
> + goto err_free_shm;
> }
>
> shm->pages = kzalloc_objs(*shm->pages, num_pages);
> --
> 2.50.1
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-04-13 9:03 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-04-08 15:52 [PATCH] tee: shm: fix shm leak in register_shm_helper() Georgiy Osokin
2026-04-13 9:03 ` Sumit Garg
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox