Jens Wiklander 9338093db9 tee: fix register_shm_helper() ...

commit d5cf5b3706 upstream.

In register_shm_helper(), fix incorrect error handling for a call to
iov_iter_extract_pages(). A case is missing for when
iov_iter_extract_pages() only got some pages and return a number larger
than 0, but not the requested amount.

This fixes a possible NULL pointer dereference following a bad input from
ioctl(TEE_IOC_SHM_REGISTER) where parts of the buffer isn't mapped.

Cc: stable@vger.kernel.org
Reported-by: Masami Ichikawa <masami256@gmail.com>
Closes: https://lore.kernel.org/op-tee/CACOXgS-Bo2W72Nj1_44c7bntyNYOavnTjJAvUbEiQfq=u9W+-g@mail.gmail.com/
Tested-by: Masami Ichikawa <masami256@gmail.com>
Fixes: 7bdee41575 ("tee: Use iov_iter to better support shared buffer registration")
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-10-15 12:00:24 +02:00

..

amdtee

…

optee

tee: optee: ffa: fix a typo of "optee_ffa_api_is_compatible"

2025-09-09 18:58:03 +02:00

tstee

…

Kconfig

…

Makefile

…

tee_core.c

…

tee_private.h

…

tee_shm_pool.c

…

tee_shm.c

tee: fix register_shm_helper()

2025-10-15 12:00:24 +02:00