Re-order these checks to check if "i" is a valid array index before using
it. This prevents a potential off by one read access.
Fixes: d6e290837e50 ("tee: add Qualcomm TEE driver")
Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org>
---
drivers/tee/qcomtee/call.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tee/qcomtee/call.c b/drivers/tee/qcomtee/call.c
index cc17a48d0ab7..ac134452cc9c 100644
--- a/drivers/tee/qcomtee/call.c
+++ b/drivers/tee/qcomtee/call.c
@@ -308,7 +308,7 @@ static int qcomtee_params_from_args(struct tee_param *params,
}
/* Release any IO and OO objects not processed. */
- for (; u[i].type && i < num_params; i++) {
+ for (; i < num_params && u[i].type; i++) {
if (u[i].type == QCOMTEE_ARG_TYPE_OO ||
u[i].type == QCOMTEE_ARG_TYPE_IO)
qcomtee_object_put(u[i].o);
--
2.51.0
Hello arm-soc maintainers,
Please pull this fix in the TEE subsystem.
Thanks,
Jens
The following changes since commit 8f5ae30d69d7543eee0d70083daf4de8fe15d585:
Linux 6.17-rc1 (2025-08-10 19:41:16 +0300)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee.git tags/tee-shm-register-fix-for-v6.17
for you to fetch changes up to d5cf5b37064b1699d946e8b7ab4ac7d7d101814c:
tee: fix register_shm_helper() (2025-09-22 08:47:00 +0200)
----------------------------------------------------------------
TEE fix2 for v6.17
Fixing incorrect error handling for a call to iov_iter_extract_pages().
----------------------------------------------------------------
Jens Wiklander (1):
tee: fix register_shm_helper()
drivers/tee/tee_shm.c | 8 ++++++++
1 file changed, 8 insertions(+)
In register_shm_helper(), fix incorrect error handling for a call to
iov_iter_extract_pages(). A case is missing for when
iov_iter_extract_pages() only got some pages and return a number larger
than 0, but not the requested amount.
This fixes a possible NULL pointer dereference following a bad input from
ioctl(TEE_IOC_SHM_REGISTER) where parts of the buffer isn't mapped.
Cc: stable(a)vger.kernel.org
Reported-by: Masami Ichikawa <masami256(a)gmail.com>
Closes: https://lore.kernel.org/op-tee/CACOXgS-Bo2W72Nj1_44c7bntyNYOavnTjJAvUbEiQfq…
Tested-by: Masami Ichikawa <masami256(a)gmail.com>
Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org>
---
Changes from v1
- Refactor the if statement as requested by Sumit
- Adding Tested-by: Masami Ichikawa <masami256(a)gmail.com
- Link to v1:
https://lore.kernel.org/op-tee/20250919124217.2934718-1-jens.wiklander@lina…
---
drivers/tee/tee_shm.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
index daf6e5cfd59a..76c54e1dc98c 100644
--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -319,6 +319,14 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
if (unlikely(len <= 0)) {
ret = len ? ERR_PTR(len) : ERR_PTR(-ENOMEM);
goto err_free_shm_pages;
+ } else if (DIV_ROUND_UP(len + off, PAGE_SIZE) != num_pages) {
+ /*
+ * If we only got a few pages, update to release the
+ * correct amount below.
+ */
+ shm->num_pages = len / PAGE_SIZE;
+ ret = ERR_PTR(-ENOMEM);
+ goto err_put_shm_pages;
}
/*
--
2.43.0
Main updates from version V18[2]:
- rework documentation for the release_fw ops
- rework function documentation in remoteproc_tee.c
- replace spinlock by mutex and generalize usage in remoteproc_tee.c
Main updates from version V17[1]:
- Fix: warning: EXPORT_SYMBOL() is used, but #include <linux/export.h>
is missing
More details are available in each patch commit message.
[1] https://lore.kernel.org/linux-remoteproc/20250613091650.2337411-1-arnaud.po…
[2] https://lore.kernel.org/linux-remoteproc/20250616075530.4106090-1-arnaud.po…
Tested-on: commit 19272b37aa4f ("Linux 6.16-rc1")
Description of the feature:
--------------------------
This series proposes the implementation of a remoteproc tee driver to
communicate with a TEE trusted application responsible for authenticating
and loading the remoteproc firmware image in an Arm secure context.
1) Principle:
The remoteproc tee driver provides services to communicate with the OP-TEE
trusted application running on the Trusted Execution Context (TEE).
The trusted application in TEE manages the remote processor lifecycle:
- authenticating and loading firmware images,
- isolating and securing the remote processor memories,
- supporting multi-firmware (e.g., TF-M + Zephyr on a Cortex-M33),
- managing the start and stop of the firmware by the TEE.
2) Format of the signed image:
Refer to:
https://github.com/OP-TEE/optee_os/blob/master/ta/remoteproc/src/remoteproc…
3) OP-TEE trusted application API:
Refer to:
https://github.com/OP-TEE/optee_os/blob/master/ta/remoteproc/include/ta_rem…
4) OP-TEE signature script
Refer to:
https://github.com/OP-TEE/optee_os/blob/master/scripts/sign_rproc_fw.py
Example of usage:
sign_rproc_fw.py --in <fw1.elf> --in <fw2.elf> --out <signed_fw.sign> --key ${OP-TEE_PATH}/keys/default.pem
5) Impact on User space Application
No sysfs impact. The user only needs to provide the signed firmware image
instead of the ELF image.
For more information about the implementation, a presentation is available here
(note that the format of the signed image has evolved between the presentation
and the integration in OP-TEE).
https://resources.linaro.org/en/resource/6c5bGvZwUAjX56fvxthxds
Arnaud Pouliquen (6):
remoteproc: core: Introduce rproc_pa_to_va helper
remoteproc: Add TEE support
remoteproc: Introduce optional release_fw operation
dt-bindings: remoteproc: Add compatibility for TEE support
remoteproc: stm32: Create sub-functions to request shutdown and
release
remoteproc: stm32: Add support of an OP-TEE TA to load the firmware
.../bindings/remoteproc/st,stm32-rproc.yaml | 58 +-
drivers/remoteproc/Kconfig | 10 +
drivers/remoteproc/Makefile | 1 +
drivers/remoteproc/remoteproc_core.c | 52 ++
drivers/remoteproc/remoteproc_internal.h | 6 +
drivers/remoteproc/remoteproc_tee.c | 708 ++++++++++++++++++
drivers/remoteproc/stm32_rproc.c | 139 +++-
include/linux/remoteproc.h | 6 +
include/linux/remoteproc_tee.h | 87 +++
9 files changed, 1023 insertions(+), 44 deletions(-)
create mode 100644 drivers/remoteproc/remoteproc_tee.c
create mode 100644 include/linux/remoteproc_tee.h
base-commit: 19272b37aa4f83ca52bdf9c16d5d81bdd1354494
--
2.25.1
In register_shm_helper(), fix incorrect error handling for a call to
iov_iter_extract_pages(). A case is missing for when
iov_iter_extract_pages() only got some pages and return a number larger
than 0, but not the requested amount.
This fixes a possible NULL pointer dereference following a bad input from
ioctl(TEE_IOC_SHM_REGISTER) where parts of the buffer isn't mapped.
Cc: stable(a)vger.kernel.org
Reported-by: Masami Ichikawa <masami256(a)gmail.com>
Closes: https://lore.kernel.org/op-tee/CACOXgS-Bo2W72Nj1_44c7bntyNYOavnTjJAvUbEiQfq…
Fixes: 7bdee4157591 ("tee: Use iov_iter to better support shared buffer registration")
Signed-off-by: Jens Wiklander <jens.wiklander(a)linaro.org>
---
drivers/tee/tee_shm.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
index daf6e5cfd59a..6ed7d030f4ed 100644
--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -316,7 +316,16 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
len = iov_iter_extract_pages(iter, &shm->pages, LONG_MAX, num_pages, 0,
&off);
- if (unlikely(len <= 0)) {
+ if (DIV_ROUND_UP(len + off, PAGE_SIZE) != num_pages) {
+ if (len > 0) {
+ /*
+ * If we only got a few pages, update to release
+ * the correct amount below.
+ */
+ shm->num_pages = len / PAGE_SIZE;
+ ret = ERR_PTR(-ENOMEM);
+ goto err_put_shm_pages;
+ }
ret = len ? ERR_PTR(len) : ERR_PTR(-ENOMEM);
goto err_free_shm_pages;
}
--
2.43.0
Hello arm-soc maintainers,
Please pull this set of patches [1] adding a Qualcomm TEE (QTEE) driver to
the TEE subsystem as described below. The QTEE patches depend on two
patches from branch
'20250911-qcom-tee-using-tee-ss-without-mem-obj-v12-2-17f07a942b8d(a)oss.qualcomm.com'
of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux
Björn asked me [2] to pull them from his tree.
This pull request is based on my previous pull request with
tee-prot-dma-buf-for-v6.18 to avoid a few conflicts when merging.
[1] https://lore.kernel.org/op-tee/20250911-qcom-tee-using-tee-ss-without-mem-o…
[2] https://lore.kernel.org/op-tee/mir6lhkj456ra3i6w7def4rrtzw663f66l66cz4s3gxx…
Thanks,
Jens
The following changes since commit dbc2868b7b57fb4caa8e44a69e882dcf8e8d59bf:
optee: smc abi: dynamic protected memory allocation (2025-09-11 11:22:43 +0200)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee.git tags/tee-qcomtee-for-v6.18
for you to fetch changes up to dcc7a571a3665a16581b5b18ca6b113f60a9a41a:
Documentation: tee: Add Qualcomm TEE driver (2025-09-15 17:34:06 +0200)
----------------------------------------------------------------
Add Qualcomm TEE driver (QTEE)
This introduces a Trusted Execution Environment (TEE) driver for
Qualcomm TEE (QTEE).
QTEE enables Trusted Applications (TAs) and services to run securely. It
uses an object-based interface, where each service is an object with
sets of operations.
Kernel and userspace services are also available to QTEE through a
similar approach. QTEE makes callback requests that are converted into
object invocations. These objects can represent services within the
kernel or userspace process.
We extend the TEE subsystem to understand object parameters and an ioctl
call so client can invoke objects in QTEE:
- TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF_*
- TEE_IOC_OBJECT_INVOKE
The existing ioctl calls TEE_IOC_SUPPL_RECV and TEE_IOC_SUPPL_SEND are
used for invoking services in the userspace process by QTEE.
The TEE backend driver uses the QTEE Transport Message to communicate
with QTEE. Interactions through the object INVOKE interface are
translated into QTEE messages. Likewise, object invocations from QTEE
for userspace objects are converted into SEND/RECV ioctl calls to
supplicants.
----------------------------------------------------------------
Amirreza Zarrabi (11):
firmware: qcom: tzmem: export shm_bridge create/delete
firmware: qcom: scm: add support for object invocation
tee: allow a driver to allocate a tee_device without a pool
tee: add close_context to TEE driver operation
tee: add TEE_IOCTL_PARAM_ATTR_TYPE_UBUF
tee: add TEE_IOCTL_PARAM_ATTR_TYPE_OBJREF
tee: increase TEE_MAX_ARG_SIZE to 4096
tee: add Qualcomm TEE driver
tee: qcom: add primordial object
tee: qcom: enable TEE_IOC_SHM_ALLOC ioctl
Documentation: tee: Add Qualcomm TEE driver
Jens Wiklander (1):
Merge branch '20250911-qcom-tee-using-tee-ss-without-mem-obj-v12-2-17f07a942b8d(a)oss.qualcomm.com' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux
Documentation/tee/index.rst | 1 +
Documentation/tee/qtee.rst | 96 ++++
MAINTAINERS | 7 +
drivers/firmware/qcom/qcom_scm.c | 119 ++++
drivers/firmware/qcom/qcom_scm.h | 7 +
drivers/firmware/qcom/qcom_tzmem.c | 63 ++-
drivers/tee/Kconfig | 1 +
drivers/tee/Makefile | 1 +
drivers/tee/qcomtee/Kconfig | 12 +
drivers/tee/qcomtee/Makefile | 9 +
drivers/tee/qcomtee/async.c | 182 ++++++
drivers/tee/qcomtee/call.c | 820 +++++++++++++++++++++++++++
drivers/tee/qcomtee/core.c | 915 +++++++++++++++++++++++++++++++
drivers/tee/qcomtee/mem_obj.c | 169 ++++++
drivers/tee/qcomtee/primordial_obj.c | 113 ++++
drivers/tee/qcomtee/qcomtee.h | 185 +++++++
drivers/tee/qcomtee/qcomtee_msg.h | 304 ++++++++++
drivers/tee/qcomtee/qcomtee_object.h | 316 +++++++++++
drivers/tee/qcomtee/shm.c | 150 +++++
drivers/tee/qcomtee/user_obj.c | 692 +++++++++++++++++++++++
drivers/tee/tee_core.c | 127 ++++-
drivers/tee/tee_private.h | 6 -
include/linux/firmware/qcom/qcom_scm.h | 6 +
include/linux/firmware/qcom/qcom_tzmem.h | 15 +
include/linux/tee_core.h | 54 +-
include/linux/tee_drv.h | 12 +
include/uapi/linux/tee.h | 56 +-
27 files changed, 4410 insertions(+), 28 deletions(-)
create mode 100644 Documentation/tee/qtee.rst
create mode 100644 drivers/tee/qcomtee/Kconfig
create mode 100644 drivers/tee/qcomtee/Makefile
create mode 100644 drivers/tee/qcomtee/async.c
create mode 100644 drivers/tee/qcomtee/call.c
create mode 100644 drivers/tee/qcomtee/core.c
create mode 100644 drivers/tee/qcomtee/mem_obj.c
create mode 100644 drivers/tee/qcomtee/primordial_obj.c
create mode 100644 drivers/tee/qcomtee/qcomtee.h
create mode 100644 drivers/tee/qcomtee/qcomtee_msg.h
create mode 100644 drivers/tee/qcomtee/qcomtee_object.h
create mode 100644 drivers/tee/qcomtee/shm.c
create mode 100644 drivers/tee/qcomtee/user_obj.c