Re: [PATCH] tee: shm: fix shm leak in register_shm_helper()

Jens Wiklander <[email protected]> Mon, 27 Apr 2026 15:41:07 +0200

Newsgroups	org.trustedfirmware.lists.op-tee,org.kernel.vger.linux-kernel,org.kernel.vger.stable
Message-ID	<CAHUa44H2hsPfBFvQwiC4DvSaZ8Lag8S0aOy_KTY5z+b=WQdTLA@mail.gmail.com>

Hi,

On Mon, Apr 13, 2026 at 11:03 AM Sumit Garg <[email protected]> wrote:
>
> On Wed, Apr 08, 2026 at 06:52:03PM +0300, Georgiy Osokin wrote:
> > register_shm_helper() allocates shm before calling
> > iov_iter_npages(). If iov_iter_npages() returns 0, the function
> > jumps to err_ctx_put and leaks shm.
> >
> > This can be triggered by TEE_IOC_SHM_REGISTER with
> > struct tee_ioctl_shm_register_data where length is 0.
> >
> > Jump to err_free_shm instead.
> >
> > Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
> > Cc: [email protected]
> > Cc: [email protected]
> > Signed-off-by: Georgiy Osokin <[email protected]>
> > ---
> >  drivers/tee/tee_shm.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
>
> Thanks for the fix, FWIW:
>
> Reviewed-by: Sumit Garg <[email protected]>

Looks good. I'm picking up this.

Cheers,
Jens