[lvc-project] Patch "tee: shm: fix shm leak in register_shm_helper()" has been added to the 6.12-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    tee: shm: fix shm leak in register_shm_helper()

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tee-shm-fix-shm-leak-in-register_shm_helper.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From 26682f5efc276e3ad96d102019472bfbf03833b2 Mon Sep 17 00:00:00 2001
From: Georgiy Osokin <g.osokin at auroraos.dev>
Date: Wed, 8 Apr 2026 18:52:03 +0300
Subject: tee: shm: fix shm leak in register_shm_helper()

From: Georgiy Osokin <g.osokin at auroraos.dev>

commit 26682f5efc276e3ad96d102019472bfbf03833b2 upstream.

register_shm_helper() allocates shm before calling
iov_iter_npages(). If iov_iter_npages() returns 0, the function
jumps to err_ctx_put and leaks shm.

This can be triggered by TEE_IOC_SHM_REGISTER with
struct tee_ioctl_shm_register_data where length is 0.

Jump to err_free_shm instead.

Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
Cc: stable at vger.kernel.org
Cc: lvc-project at linuxtesting.org
Signed-off-by: Georgiy Osokin <g.osokin at auroraos.dev>
Reviewed-by: Sumit Garg <sumit.garg at oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander at linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 drivers/tee/tee_shm.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -307,7 +307,7 @@ register_shm_helper(struct tee_context *
 	num_pages = iov_iter_npages(iter, INT_MAX);
 	if (!num_pages) {
 		ret = ERR_PTR(-ENOMEM);
-		goto err_ctx_put;
+		goto err_free_shm;
 	}
 
 	shm->pages = kcalloc(num_pages, sizeof(*shm->pages), GFP_KERNEL);


Patches currently in stable-queue which might be from g.osokin at auroraos.dev are

queue-6.12/tee-shm-fix-shm-leak-in-register_shm_helper.patch