]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
tee: fix register_shm_helper()
authorJens Wiklander <jens.wiklander@linaro.org>
Fri, 19 Sep 2025 08:48:31 +0000 (10:48 +0200)
committerJens Wiklander <jens.wiklander@linaro.org>
Mon, 22 Sep 2025 06:47:00 +0000 (08:47 +0200)
commitd5cf5b37064b1699d946e8b7ab4ac7d7d101814c
treeb2628fc0c79ab5afda06485f14f6e60d43935837
parent8f5ae30d69d7543eee0d70083daf4de8fe15d585
tee: fix register_shm_helper()

In register_shm_helper(), fix incorrect error handling for a call to
iov_iter_extract_pages(). A case is missing for when
iov_iter_extract_pages() only got some pages and return a number larger
than 0, but not the requested amount.

This fixes a possible NULL pointer dereference following a bad input from
ioctl(TEE_IOC_SHM_REGISTER) where parts of the buffer isn't mapped.

Cc: stable@vger.kernel.org
Reported-by: Masami Ichikawa <masami256@gmail.com>
Closes: https://lore.kernel.org/op-tee/CACOXgS-Bo2W72Nj1_44c7bntyNYOavnTjJAvUbEiQfq=u9W+-g@mail.gmail.com/
Tested-by: Masami Ichikawa <masami256@gmail.com>
Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
drivers/tee/tee_shm.c