Jann Horn 39bb67edcc tee: Prevent size calculation wraparound on 32-bit kernels ...

The current code around TEE_IOCTL_PARAM_SIZE() is a bit wrong on
32-bit kernels: Multiplying a user-provided 32-bit value with the
size of a structure can wrap around on such platforms.

Fix it by using saturating arithmetic for the size calculation.

This has no security consequences because, in all users of
TEE_IOCTL_PARAM_SIZE(), the subsequent kcalloc() implicitly checks
for wrapping.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Tested-by: Rouven Czerwinski <rouven.czerwinski@linaro.org>

2025-04-30 14:57:03 +02:00

..

amdtee

tee: Refactor TEE subsystem header files

2024-04-03 09:19:31 +02:00

optee

tee: optee: smc: remove unnecessary NULL check before release_firmware()

2025-04-25 14:43:42 +02:00

tstee

tee: tstee: Add Trusted Services TEE driver

2024-04-03 14:03:09 +02:00

Kconfig

tee: tstee: Add Trusted Services TEE driver

2024-04-03 14:03:09 +02:00

Makefile

tee: tstee: Add Trusted Services TEE driver

2024-04-03 14:03:09 +02:00

tee_core.c

tee: Prevent size calculation wraparound on 32-bit kernels

2025-04-30 14:57:03 +02:00

tee_private.h

tee: Refactor TEE subsystem header files

2024-04-03 09:19:31 +02:00

tee_shm_pool.c

tee: Refactor TEE subsystem header files

2024-04-03 09:19:31 +02:00

tee_shm.c

tee: optee: Move pool_op helper functions

2024-04-03 13:58:20 +02:00