Messages in this thread Patch in this message | | | Date | Sat, 6 Jan 2018 12:22:30 +0300 | From | Dan Carpenter <> | Subject | [PATCH] tee: shm: Potential NULL dereference calling tee_shm_register() |
| |
get_user_pages_fast() can return zero in certain error paths. We should handle that or else it means we accidentally return ERR_PTR(0) which is NULL instead of an error pointer. The callers are not expecting that and will crash with a NULL dereference.
Fixes: 033ddf12bcf5 ("tee: add register user memory") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 04e1b8b37046..cdeb4156acda 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -283,7 +283,7 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr, if (rc > 0) shm->num_pages = rc; if (rc != num_pages) { - if (rc > 0) + if (rc >= 0) rc = -ENOMEM; ret = ERR_PTR(rc); goto err;
| |