Commit 18549bf4 authored by Sumit Garg's avatar Sumit Garg Committed by Jens Wiklander
Browse files

tee: optee: Fix incorrect page free bug 



Pointer to the allocated pages (struct page *page) has already
progressed towards the end of allocation. It is incorrect to perform
__free_pages(page, order) using this pointer as we would free any
arbitrary pages. Fix this by stop modifying the page pointer.

Fixes: ec185dd3 ("optee: Fix memory leak when failing to register shm pages")
Cc: stable@vger.kernel.org
Reported-by: default avatarPatrik Lantz <patrik.lantz@axis.com>
Signed-off-by: default avatarSumit Garg <sumit.garg@linaro.org>
Reviewed-by: default avatarTyler Hicks <tyhicks@linux.microsoft.com>
Signed-off-by: default avatarJens Wiklander <jens.wiklander@linaro.org>
parent dfd0743f

drivers/tee/optee/core.c

+2 −4
Original line number Diff line number Diff line
@@ -48,10 +48,8 @@ int optee_pool_op_alloc_helper(struct tee_shm_pool_mgr *poolm, 
			goto err;

		}



		for (i = 0; i < nr_pages; i++) {

			pages[i] = page;

			page++;

		}

		for (i = 0; i < nr_pages; i++)

			pages[i] = page + i;



		shm->flags |= TEE_SHM_REGISTER;

		rc = shm_register(shm->ctx, shm, pages, nr_pages,