Georgiy Osokin c10c9c48b2 tee: shm: fix shm leak in register_shm_helper() ...

commit 26682f5efc upstream.

register_shm_helper() allocates shm before calling
iov_iter_npages(). If iov_iter_npages() returns 0, the function
jumps to err_ctx_put and leaks shm.

This can be triggered by TEE_IOC_SHM_REGISTER with
struct tee_ioctl_shm_register_data where length is 0.

Jump to err_free_shm instead.

Fixes: 7bdee41575 ("tee: Use iov_iter to better support shared buffer registration")
Cc: stable@vger.kernel.org
Cc: lvc-project@linuxtesting.org
Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-06-19 13:44:02 +02:00

..

amdtee

…

optee

…

qcomtee

tee: qcomtee: add missing va_end in early return qcomtee_object_user_init()

2026-06-19 13:43:51 +02:00

tstee

…

Kconfig

…

Makefile

…

tee_core.c

…

tee_heap.c

…

tee_private.h

…

tee_shm_pool.c

…

tee_shm.c

tee: shm: fix shm leak in register_shm_helper()

2026-06-19 13:44:02 +02:00