From c94f31b526fe658c25dd2d07c90486a85437f01c Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Fri, 22 Dec 2017 17:51:50 +0000 Subject: tee: shm: don't put_page on null shm->pages In the case that shm->pages fails to allocate, the current exit error path will try to put_page on a null shm->pages and cause a null pointer dereference when accessing shm->pages[n]. Fix this by only performing the put_page and kfree on shm->pages if it is not null. Detected by CoverityScan, CID#1463283 ("Dereference after null check") Fixes: 033ddf12bcf5 ("tee: add register user memory") Signed-off-by: Colin Ian King Signed-off-by: Jens Wiklander --- drivers/tee/tee_shm.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) (limited to 'drivers/tee') diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 511eb298949b..6f36da9ee412 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -335,9 +335,11 @@ err: idr_remove(&teedev->idr, shm->id); mutex_unlock(&teedev->mutex); } - for (n = 0; n < shm->num_pages; n++) - put_page(shm->pages[n]); - kfree(shm->pages); + if (shm->pages) { + for (n = 0; n < shm->num_pages; n++) + put_page(shm->pages[n]); + kfree(shm->pages); + } } kfree(shm); teedev_ctx_put(ctx); -- cgit v1.2.3