Unverified Commit 1d4e7d9f authored by Arnd Bergmann's avatar Arnd Bergmann
Browse files

Merge tag 'tee-qcomtee-fixes-for-v6.18' of... 

Merge tag 'tee-qcomtee-fixes-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes

TEE QTEE fixes for v6.18

- Adds ARCH_QCOM dependency for the QTEE driver
- Fixing return values for copy_from_user() failures
- Guarding against potential off by one read

* tag 'tee-qcomtee-fixes-for-v6.18' of git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
  tee: QCOMTEE should depend on ARCH_QCOM
  tee: qcom: return -EFAULT instead of -EINVAL if copy_from_user() fails
  tee: qcom: prevent potential off by one read
parents 3a866087 3b63efa2

drivers/tee/qcomtee/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -2,6 +2,7 @@ 
# Qualcomm Trusted Execution Environment Configuration

config QCOMTEE

	tristate "Qualcomm TEE Support"

	depends on ARCH_QCOM || COMPILE_TEST

	depends on !CPU_BIG_ENDIAN

	select QCOM_SCM

	select QCOM_TZMEM_MODE_SHMBRIDGE

drivers/tee/qcomtee/call.c

+1 −1
Original line number Diff line number Diff line
@@ -308,7 +308,7 @@ static int qcomtee_params_from_args(struct tee_param *params, 
	}



	/* Release any IO and OO objects not processed. */

	for (; u[i].type && i < num_params; i++) {

	for (; i < num_params && u[i].type; i++) {

		if (u[i].type == QCOMTEE_ARG_TYPE_OO ||

		    u[i].type == QCOMTEE_ARG_TYPE_IO)

			qcomtee_object_put(u[i].o);

drivers/tee/qcomtee/core.c

+1 −1
Original line number Diff line number Diff line
@@ -424,7 +424,7 @@ static int qcomtee_prepare_msg(struct qcomtee_object_invoke_ctx *oic, 
		if (!(u[i].flags & QCOMTEE_ARG_FLAGS_UADDR))

			memcpy(msgptr, u[i].b.addr, u[i].b.size);

		else if (copy_from_user(msgptr, u[i].b.uaddr, u[i].b.size))

			return -EINVAL;

			return -EFAULT;



		offset += qcomtee_msg_offset_align(u[i].b.size);

		ib++;