diff options
| author | Colin Ian King <colin.king@canonical.com> | 2017-12-22 17:51:50 +0000 |
|---|---|---|
| committer | Victor Chong <victor.chong@linaro.org> | 2018-02-21 15:40:49 +0000 |
| commit | ed384bc362644588e8d4594ea1614ad4bc3e1feb (patch) | |
| tree | d8aa4a54fdd4b6fc14963c9a88af44155d90c4dd /drivers | |
| parent | 18fee2106b39559a1000094df83566482d793a28 (diff) | |
BACKPORT: tee: shm: don't put_page on null shm->pages
In the case that shm->pages fails to allocate, the current exit
error path will try to put_page on a null shm->pages and cause
a null pointer dereference when accessing shm->pages[n]. Fix this
by only performing the put_page and kfree on shm->pages if it
is not null.
Detected by CoverityScan, CID#1463283 ("Dereference after null check")
Change-Id: I4874df9fce449834fdf9064c718c2d2517f69bc4
Fixes: 033ddf12bcf5 ("tee: add register user memory")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
(cherry picked from commit c94f31b526fe658c25dd2d07c90486a85437f01c)
Signed-off-by: Victor Chong <victor.chong@linaro.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/tee/tee_shm.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index fd3ff05eb8ca..4f0ae2e98010 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -335,9 +335,11 @@ err: idr_remove(&teedev->idr, shm->id); mutex_unlock(&teedev->mutex); } - for (n = 0; n < shm->num_pages; n++) - put_page(shm->pages[n]); - kfree(shm->pages); + if (shm->pages) { + for (n = 0; n < shm->num_pages; n++) + put_page(shm->pages[n]); + kfree(shm->pages); + } } kfree(shm); teedev_ctx_put(ctx); |