From 196cb35a3efaa6f669503fd80f1b30dede8869ba Mon Sep 17 00:00:00 2001 From: Colin Ian King Date: Fri, 22 Dec 2017 17:51:50 +0000 Subject: [PATCH] BACKPORT: tee: shm: don't put_page on null shm->pages In the case that shm->pages fails to allocate, the current exit error path will try to put_page on a null shm->pages and cause a null pointer dereference when accessing shm->pages[n]. Fix this by only performing the put_page and kfree on shm->pages if it is not null. Detected by CoverityScan, CID#1463283 ("Dereference after null check") Change-Id: I9dbf1a729d784c1c13eabe0d70c48f1f12b2e5b3 Fixes: 033ddf12bcf5 ("tee: add register user memory") Signed-off-by: Colin Ian King Signed-off-by: Jens Wiklander (cherry picked from commit c94f31b526fe658c25dd2d07c90486a85437f01c) Signed-off-by: Victor Chong --- drivers/tee/tee_shm.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index fd3ff05eb8ca..4f0ae2e98010 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -335,9 +335,11 @@ err: idr_remove(&teedev->idr, shm->id); mutex_unlock(&teedev->mutex); } - for (n = 0; n < shm->num_pages; n++) - put_page(shm->pages[n]); - kfree(shm->pages); + if (shm->pages) { + for (n = 0; n < shm->num_pages; n++) + put_page(shm->pages[n]); + kfree(shm->pages); + } } kfree(shm); teedev_ctx_put(ctx);