diff options
| author | Arnd Bergmann <arnd@arndb.de> | 2025-09-24 23:12:17 +0200 |
|---|---|---|
| committer | Arnd Bergmann <arnd@arndb.de> | 2025-09-24 23:12:20 +0200 |
| commit | 0a8c31049107ed39a68d21849e7b1b87856b240e (patch) | |
| tree | 2ac9f3dedd597072eebeb8b72901e1f27fa54f70 | |
| parent | ff0bebab778c7474c328bc7e5e9bf3c39bf4fc1a (diff) | |
| parent | d5cf5b37064b1699d946e8b7ab4ac7d7d101814c (diff) | |
Merge tag 'tee-shm-register-fix-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into soc/drivers
TEE fix2 for v6.17
Fixing incorrect error handling for a call to iov_iter_extract_pages().
* tag 'tee-shm-register-fix-for-v6.17' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
tee: fix register_shm_helper()
Link: https://lore.kernel.org/r/20250924083404.GA3747732@rayden
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
| -rw-r--r-- | drivers/tee/tee_shm.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index e195c892431d..c147ab215bc7 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -465,6 +465,14 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags, if (unlikely(len <= 0)) { ret = len ? ERR_PTR(len) : ERR_PTR(-ENOMEM); goto err_free_shm_pages; + } else if (DIV_ROUND_UP(len + off, PAGE_SIZE) != num_pages) { + /* + * If we only got a few pages, update to release the + * correct amount below. + */ + shm->num_pages = len / PAGE_SIZE; + ret = ERR_PTR(-ENOMEM); + goto err_put_shm_pages; } /* |