diff options
| author | Colin Ian King <colin.king@canonical.com> | 2017-12-22 17:51:50 +0000 |
|---|---|---|
| committer | Jens Wiklander <jens.wiklander@linaro.org> | 2017-12-28 22:20:10 +0100 |
| commit | c94f31b526fe658c25dd2d07c90486a85437f01c (patch) | |
| tree | 7742a74048136041c64b869d4ea0aae6650a51b8 /drivers/tee | |
| parent | 80ec6f5de60b6934f145b2f7e5369592bcab85f3 (diff) | |
tee: shm: don't put_page on null shm->pages
In the case that shm->pages fails to allocate, the current exit
error path will try to put_page on a null shm->pages and cause
a null pointer dereference when accessing shm->pages[n]. Fix this
by only performing the put_page and kfree on shm->pages if it
is not null.
Detected by CoverityScan, CID#1463283 ("Dereference after null check")
Fixes: 033ddf12bcf5 ("tee: add register user memory")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Diffstat (limited to 'drivers/tee')
| -rw-r--r-- | drivers/tee/tee_shm.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 511eb298949b..6f36da9ee412 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -335,9 +335,11 @@ err: idr_remove(&teedev->idr, shm->id); mutex_unlock(&teedev->mutex); } - for (n = 0; n < shm->num_pages; n++) - put_page(shm->pages[n]); - kfree(shm->pages); + if (shm->pages) { + for (n = 0; n < shm->num_pages; n++) + put_page(shm->pages[n]); + kfree(shm->pages); + } } kfree(shm); teedev_ctx_put(ctx); |