[xen staging] xen/arm: optee: fix possible memory leaks

[patchbot@xxxxxxx]

commit 664cc3c3d381e4f9a61dcb68cbd7a6a00070370e
Author:     Volodymyr Babchuk <Volodymyr_Babchuk@xxxxxxxx>
AuthorDate: Thu Oct 7 23:25:02 2021 +0000
Commit:     Stefano Stabellini <stefano.stabellini@xxxxxxxxxx>
CommitDate: Fri Oct 8 16:02:13 2021 -0700

    xen/arm: optee: fix possible memory leaks
    
    translate_noncontig() allocates domheap page for translated list
    before calling to allocate_optee_shm_buf(), which can fail for number
    of reason. Anyways, after fail we need to free the allocated page(s).
    
    Another leak is possible if the same translate_noncontig() function
    fails to get domain page. In this case it should free allocated
    optee_shm_buf prior exit. This will also free allocated domheap page.
    
    Signed-off-by: Volodymyr Babchuk <volodymyr_babchuk@xxxxxxxx>
    Acked-by: Stefano Stabellini <sstabellini@xxxxxxxxxx>
---
 xen/arch/arm/tee/optee.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/xen/arch/arm/tee/optee.c b/xen/arch/arm/tee/optee.c
index 6df0d44eb9..131d2f9a8a 100644
--- a/xen/arch/arm/tee/optee.c
+++ b/xen/arch/arm/tee/optee.c
@@ -781,7 +781,10 @@ static int translate_noncontig(struct optee_domain *ctx,
     optee_shm_buf = allocate_optee_shm_buf(ctx, param->u.tmem.shm_ref,
                                            pg_count, xen_pgs, order);
     if ( IS_ERR(optee_shm_buf) )
+    {
+        free_domheap_pages(xen_pgs, order);
         return PTR_ERR(optee_shm_buf);
+    }
 
     gfn = gaddr_to_gfn(param->u.tmem.buf_ptr &
                        ~(OPTEE_MSG_NONCONTIG_PAGE_SIZE - 1));
@@ -807,7 +810,7 @@ static int translate_noncontig(struct optee_domain *ctx,
         {
             guest_pg = get_domain_ram_page(gfn);
             if ( !guest_pg )
-                return -EINVAL;
+                goto free_shm_buf;
 
             guest_data = __map_domain_page(guest_pg);
             xen_data = __map_domain_page(xen_pgs);
@@ -854,6 +857,7 @@ err_unmap:
     unmap_domain_page(guest_data);
     unmap_domain_page(xen_data);
     put_page(guest_pg);
+free_shm_buf:
     free_optee_shm_buf(ctx, optee_shm_buf->cookie);
 
     return -EINVAL;
--
generated by git-patchbot for /home/xen/git/xen.git#staging