]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
tee: shm: fix shm leak in register_shm_helper()
authorGeorgiy Osokin <g.osokin@auroraos.dev>
Wed, 8 Apr 2026 15:52:03 +0000 (18:52 +0300)
committerJens Wiklander <jens.wiklander@linaro.org>
Wed, 20 May 2026 06:49:09 +0000 (08:49 +0200)
commit26682f5efc276e3ad96d102019472bfbf03833b2
tree92701fa7809249e41fa9f5cc6c43aee913152a2c
parentc15d7a2a11ea055bcecc0b538ae8ba79475637f9
tee: shm: fix shm leak in register_shm_helper()

register_shm_helper() allocates shm before calling
iov_iter_npages(). If iov_iter_npages() returns 0, the function
jumps to err_ctx_put and leaks shm.

This can be triggered by TEE_IOC_SHM_REGISTER with
struct tee_ioctl_shm_register_data where length is 0.

Jump to err_free_shm instead.

Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
Cc: stable@vger.kernel.org
Cc: lvc-project@linuxtesting.org
Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
drivers/tee/tee_shm.c