tee: shm: fix shm leak in register_shm_helper()

[PATCH] tee: shm: fix shm leak in register_shm_helper()

Posted by Georgiy Osokin 2 months, 1 week ago

register_shm_helper() allocates shm before calling
iov_iter_npages(). If iov_iter_npages() returns 0, the function
jumps to err_ctx_put and leaks shm.

This can be triggered by TEE_IOC_SHM_REGISTER with
struct tee_ioctl_shm_register_data where length is 0.

Jump to err_free_shm instead.

Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
Cc: stable@vger.kernel.org
Cc: lvc-project@linuxtesting.org
Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
---
 drivers/tee/tee_shm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
index e9ea9f80cfd9..6742b3579c86 100644
--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -435,7 +435,7 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
 	num_pages = iov_iter_npages(iter, INT_MAX);
 	if (!num_pages) {
 		ret = ERR_PTR(-ENOMEM);
-		goto err_ctx_put;
+		goto err_free_shm;
 	}
 
 	shm->pages = kzalloc_objs(*shm->pages, num_pages);
-- 
2.50.1

Re: [PATCH] tee: shm: fix shm leak in register_shm_helper()

Posted by Sumit Garg 2 months ago

On Wed, Apr 08, 2026 at 06:52:03PM +0300, Georgiy Osokin wrote:
> register_shm_helper() allocates shm before calling
> iov_iter_npages(). If iov_iter_npages() returns 0, the function
> jumps to err_ctx_put and leaks shm.
> 
> This can be triggered by TEE_IOC_SHM_REGISTER with
> struct tee_ioctl_shm_register_data where length is 0.
> 
> Jump to err_free_shm instead.
> 
> Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
> Cc: stable@vger.kernel.org
> Cc: lvc-project@linuxtesting.org
> Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
> ---
>  drivers/tee/tee_shm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Thanks for the fix, FWIW:

Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

-Sumit

> 
> diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
> index e9ea9f80cfd9..6742b3579c86 100644
> --- a/drivers/tee/tee_shm.c
> +++ b/drivers/tee/tee_shm.c
> @@ -435,7 +435,7 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
>  	num_pages = iov_iter_npages(iter, INT_MAX);
>  	if (!num_pages) {
>  		ret = ERR_PTR(-ENOMEM);
> -		goto err_ctx_put;
> +		goto err_free_shm;
>  	}
>  
>  	shm->pages = kzalloc_objs(*shm->pages, num_pages);
> -- 
> 2.50.1
>

Re: [PATCH] tee: shm: fix shm leak in register_shm_helper()

Posted by Jens Wiklander 1 month, 2 weeks ago

Hi,

On Mon, Apr 13, 2026 at 11:03 AM Sumit Garg <sumit.garg@kernel.org> wrote:
>
> On Wed, Apr 08, 2026 at 06:52:03PM +0300, Georgiy Osokin wrote:
> > register_shm_helper() allocates shm before calling
> > iov_iter_npages(). If iov_iter_npages() returns 0, the function
> > jumps to err_ctx_put and leaks shm.
> >
> > This can be triggered by TEE_IOC_SHM_REGISTER with
> > struct tee_ioctl_shm_register_data where length is 0.
> >
> > Jump to err_free_shm instead.
> >
> > Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
> > Cc: stable@vger.kernel.org
> > Cc: lvc-project@linuxtesting.org
> > Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
> > ---
> >  drivers/tee/tee_shm.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
>
> Thanks for the fix, FWIW:
>
> Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

Looks good. I'm picking up this.

Cheers,
Jens