Re: [PATCH 1/1] tee: fix page count in register_shm_helper() error path

[Jens Wiklander]

Hi,

On Mon, Aug 31, 2026 at 12:58 PM Shukai Ni <shukai.ni@xxxxxxxxxxx> wrote:
>
> iov_iter_extract_pages() returns the number of bytes extracted and sets off
> to the offset into the first page. For the iterator, the number of pages
> pinned is therefore DIV_ROUND_UP(len + off, PAGE_SIZE).
>
> The partial-extraction error path instead records len / PAGE_SIZE. For an
> unaligned buffer this can undercount by one, causing unpin_user_pages() to
> leave a page pinned.
>
> Fixes: d5cf5b37064b ("tee: fix register_shm_helper()")
> Cc: stable@xxxxxxxxxxxxxxx
> Co-developed-by: Jo Van Bulck <jo.vanbulck@xxxxxxxxxxxxxx>
> Signed-off-by: Jo Van Bulck <jo.vanbulck@xxxxxxxxxxxxxx>
> Signed-off-by: Shukai Ni <shukai.ni@xxxxxxxxxxx>
> ---
>  drivers/tee/tee_shm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
> index 6742b35..fa446e4 100644
> --- a/drivers/tee/tee_shm.c
> +++ b/drivers/tee/tee_shm.c
> @@ -454,7 +454,7 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
>                  * If we only got a few pages, update to release the
>                  * correct amount below.
>                  */
> -               shm->num_pages = len / PAGE_SIZE;
> +               shm->num_pages = DIV_ROUND_UP(len + off, PAGE_SIZE);
>                 ret = ERR_PTR(-ENOMEM);
>                 goto err_put_shm_pages;
>         }
> --
> 2.55.0
>

Looks good. Sumit, do you agree?

Cheers,
Jens