Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'tee-fixes-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes
TEE fixes for v6.17
- Fixing a memory leak in the error path for tee_dyn_shm_alloc_helper()
- Fixing a NULL pointer dereference in tee_shm_put()
* tag 'tee-fixes-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
tee: fix memory leak in tee_dyn_shm_alloc_helper
tee: fix NULL pointer dereference in tee_shm_put
Link: https://lore.kernel.org/r/20250819122641.GA3486750@rayden
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+10
-4
+10
-4
drivers/tee/tee_shm.c
+10
-4
drivers/tee/tee_shm.c
···
230
230
pages = kcalloc(nr_pages, sizeof(*pages), GFP_KERNEL);
231
231
if (!pages) {
232
232
rc = -ENOMEM;
233
-
goto err;
233
+
goto err_pages;
234
234
}
235
235
236
236
for (i = 0; i < nr_pages; i++)
···
243
243
rc = shm_register(shm->ctx, shm, pages, nr_pages,
244
244
(unsigned long)shm->kaddr);
245
245
if (rc)
246
-
goto err;
246
+
goto err_kfree;
247
247
}
248
248
249
249
return 0;
250
-
err:
250
+
err_kfree:
251
+
kfree(pages);
252
+
err_pages:
251
253
free_pages_exact(shm->kaddr, shm->size);
252
254
shm->kaddr = NULL;
253
255
return rc;
···
562
560
*/
563
561
void tee_shm_put(struct tee_shm *shm)
564
562
{
565
-
struct tee_device *teedev = shm->ctx->teedev;
563
+
struct tee_device *teedev;
566
564
bool do_release = false;
567
565
566
+
if (!shm || !shm->ctx || !shm->ctx->teedev)
567
+
return;
568
+
569
+
teedev = shm->ctx->teedev;
568
570
mutex_lock(&teedev->mutex);
569
571
if (refcount_dec_and_test(&shm->refcount)) {
570
572
/*