torvalds/linux
torvalds/linux
2
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
Code

tee: fix memory leak in tee_dyn_shm_alloc_helper

Browse Source 
When shm_register() fails in tee_dyn_shm_alloc_helper(), the pre-allocated
pages array is not freed, resulting in a memory leak.

Fixes: cf4441503e ("tee: optee: Move pool_op helper functions")
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
This commit is contained in:
Pei Xiao 2025-07-23 14:22:41 +08:00 committed by Jens Wiklander
parent e4a718a3a4
commit 50a74d0095
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/tee/tee_shm.c
View File

@ -230,7 +230,7 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align,
pages = kcalloc(nr_pages, sizeof(*pages), GFP_KERNEL); pages = kcalloc(nr_pages, sizeof(*pages), GFP_KERNEL);
if (!pages) { if (!pages) {
rc = -ENOMEM; rc = -ENOMEM;
goto err; goto err_pages;
} }
for (i = 0; i < nr_pages; i++) for (i = 0; i < nr_pages; i++)
@ -243,11 +243,13 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align,
rc = shm_register(shm->ctx, shm, pages, nr_pages, rc = shm_register(shm->ctx, shm, pages, nr_pages,
(unsigned long)shm->kaddr); (unsigned long)shm->kaddr);
if (rc) if (rc)
goto err; goto err_kfree;
} }
return 0; return 0;
err: err_kfree:
kfree(pages);
err_pages:
free_pages_exact(shm->kaddr, shm->size); free_pages_exact(shm->kaddr, shm->size);
shm->kaddr = NULL; shm->kaddr = NULL;
return rc; return rc;