Commit c94f31b5 authored Dec 22, 2017 by Colin Ian King Committed by Jens Wiklander Dec 28, 2017

tee: shm: don't put_page on null shm->pages



In the case that shm->pages fails to allocate, the current exit
error path will try to put_page on a null shm->pages and cause
a null pointer dereference when accessing shm->pages[n]. Fix this
by only performing the put_page and kfree on shm->pages if it
is not null.

Detected by CoverityScan, CID#1463283 ("Dereference after null check")

Fixes: 033ddf12 ("tee: add register user memory")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

parent 80ec6f5d

drivers/tee/tee_shm.c

+5 −3

Original line number	Diff line number	Diff line
		@@ -335,10 +335,12 @@ err:
		idr_remove(&teedev->idr, shm->id);
		mutex_unlock(&teedev->mutex);
		}
		if (shm->pages) {
		for (n = 0; n < shm->num_pages; n++)
		put_page(shm->pages[n]);
		kfree(shm->pages);
		}
		}
		kfree(shm);
		teedev_ctx_put(ctx);
		tee_device_put(teedev);

Admin message