[PATCH 0/1] tee: fix page pin leak in register_shm_helper()

[Shukai Ni]

Hi Jens,

This one-patch series fixes a page-pin leak in register_shm_helper() after
iov_iter_extract_pages() partially extracts an unaligned user buffer. The
cleanup path undercounts the pinned pages by one and loses the final pin
when it frees the page array.

The issue was reproduced on an x86_64 7.0.0-29-generic kernel with 4 KiB
pages. On the unpatched kernel, each failing registration increased
nr_foll_pin_acquired - nr_foll_pin_released by one.

The faulty code is also present in current mainline, linux-next, the TEE
maintainer's next branch, and the supported 7.2.y, 7.1.y, 6.18.y, and
6.12.y branches.

Regards,
Shukai

Shukai Ni (1):
  tee: fix page count in register_shm_helper() error path

 drivers/tee/tee_shm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)


base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
-- 
2.55.0