Re: [PATCH 1/1] tee: fix page count in register_shm_helper() error path

[Jens Wiklander]

On Thu, Nov 5, 2026 at 1:16 PM Sumit Garg <sumit.garg@xxxxxxxxxx> wrote:
>
> On Tue, 03 Nov 2026 at 19:11:06 +0100, Jens Wiklander wrote:
> >Hi,
> >
> >On Mon, Aug 31, 2026 at 12:58 PM Shukai Ni <shukai.ni@xxxxxxxxxxx> wrote:
> >>
> >> iov_iter_extract_pages() returns the number of bytes extracted and sets off
> >> to the offset into the first page. For the iterator, the number of pages
> >> pinned is therefore DIV_ROUND_UP(len + off, PAGE_SIZE).
> >>
> >> The partial-extraction error path instead records len / PAGE_SIZE. For an
> >> unaligned buffer this can undercount by one, causing unpin_user_pages() to
> >> leave a page pinned.
> >>
> >> Fixes: d5cf5b37064b ("tee: fix register_shm_helper()")
> >> Cc: stable@xxxxxxxxxxxxxxx
> >> Co-developed-by: Jo Van Bulck <jo.vanbulck@xxxxxxxxxxxxxx>
> >> Signed-off-by: Jo Van Bulck <jo.vanbulck@xxxxxxxxxxxxxx>
> >> Signed-off-by: Shukai Ni <shukai.ni@xxxxxxxxxxx>
> >> ---
> >>  drivers/tee/tee_shm.c | 2 +-
> >>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
> >> index 6742b35..fa446e4 100644
> >> --- a/drivers/tee/tee_shm.c
> >> +++ b/drivers/tee/tee_shm.c
> >> @@ -454,7 +454,7 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
> >>                  * If we only got a few pages, update to release the
> >>                  * correct amount below.
> >>                  */
> >> -               shm->num_pages = len / PAGE_SIZE;
> >> +               shm->num_pages = DIV_ROUND_UP(len + off, PAGE_SIZE);
> >>                 ret = ERR_PTR(-ENOMEM);
> >>                 goto err_put_shm_pages;
> >>         }
> >> --
> >> 2.55.0
> >>
> >
> >Looks good. Sumit, do you agree?
>
> Sounds like a reasonable fix to me, feel free to add:
>
> Reviewed-by: Sumit Garg <sumit.garg@xxxxxxxxxxxxxxxx>

I'm picking this up.

Cheers,
Jens