summaryrefslogtreecommitdiffstats
path: root/drivers/tee
diff options
context:
space:
mode:
authorSumit Garg <sumit.garg@linaro.org>2021-12-16 06:47:25 +0100
committerJens Wiklander <jens.wiklander@linaro.org>2021-12-16 15:32:37 +0100
commit18549bf4b21c739a9def39f27dcac53e27286ab5 (patch)
tree8ba72382308c789e01ee6941f453a34fa56108f2 /drivers/tee
parenttee: handle lookup of shm with reference count 0 (diff)
downloadlinux-18549bf4b21c739a9def39f27dcac53e27286ab5.tar.xz
linux-18549bf4b21c739a9def39f27dcac53e27286ab5.zip
tee: optee: Fix incorrect page free bug
Pointer to the allocated pages (struct page *page) has already progressed towards the end of allocation. It is incorrect to perform __free_pages(page, order) using this pointer as we would free any arbitrary pages. Fix this by stop modifying the page pointer. Fixes: ec185dd3ab25 ("optee: Fix memory leak when failing to register shm pages") Cc: stable@vger.kernel.org Reported-by: Patrik Lantz <patrik.lantz@axis.com> Signed-off-by: Sumit Garg <sumit.garg@linaro.org> Reviewed-by: Tyler Hicks <tyhicks@linux.microsoft.com> Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Diffstat (limited to 'drivers/tee')
-rw-r--r--drivers/tee/optee/core.c6
1 files changed, 2 insertions, 4 deletions
diff --git a/drivers/tee/optee/core.c b/drivers/tee/optee/core.c
index ab2edfcc6c70..2a66a5203d2f 100644
--- a/drivers/tee/optee/core.c
+++ b/drivers/tee/optee/core.c
@@ -48,10 +48,8 @@ int optee_pool_op_alloc_helper(struct tee_shm_pool_mgr *poolm,
goto err;
}
- for (i = 0; i < nr_pages; i++) {
- pages[i] = page;
- page++;
- }
+ for (i = 0; i < nr_pages; i++)
+ pages[i] = page + i;
shm->flags |= TEE_SHM_REGISTER;
rc = shm_register(shm->ctx, shm, pages, nr_pages,