From: Dan Carpenter Date: Sat, 6 Jan 2018 09:22:30 +0000 (+0300) Subject: tee: shm: Potential NULL dereference calling tee_shm_register() X-Git-Tag: v4.16-rc1~98^2~9^2 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2490cdf6435b1d3cac0dbf710cd752487c67c296;p=thirdparty%2Fkernel%2Flinux.git tee: shm: Potential NULL dereference calling tee_shm_register() get_user_pages_fast() can return zero in certain error paths. We should handle that or else it means we accidentally return ERR_PTR(0) which is NULL instead of an error pointer. The callers are not expecting that and will crash with a NULL dereference. Fixes: 033ddf12bcf5 ("tee: add register user memory") Signed-off-by: Dan Carpenter Signed-off-by: Jens Wiklander --- diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 6f36da9ee4126..556960a1bab3b 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -283,7 +283,7 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, if (rc > 0) shm->num_pages = rc; if (rc != num_pages) { - if (rc > 0) + if (rc >= 0) rc = -ENOMEM; ret = ERR_PTR(rc); goto err;