Reference in a new issue

Blame

Copy permalink

Reference in a new issue

Copy permalink

Qihang 6fa9b543f6 tee: fix params_from_user() error path in tee_ioctl_supp_recv ...

params_from_user() may acquire tee_shm references for MEMREF parameters
before failing after partially processing the supplied parameter array.

In tee_ioctl_supp_recv(), those references are currently not released on
that error path.

Fix this by freeing MEMREF references before returning when
params_from_user() fails.

Keep the final cleanup path in tee_ioctl_supp_recv() unchanged since
supp_recv() may consume and replace the supplied parameters, unlike the
other TEE ioctl callback paths.

Signed-off-by: Qihang <q.h.hack.winter@gmail.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

2026-05-20 08:49:09 +02:00

1579 lines

38 KiB

Raw Blame History