From f0e974e1e4f2c88ec4c09c7ab0fc9df6b7306d21 Mon Sep 17 00:00:00 2001
From: Ye Li <ye.li@nxp.com>
Date: Thu, 15 Jun 2023 18:09:10 +0800
Subject: [PATCH] imx: cmd_dek: Fix Uninitialized pointer read
Fix Coverity (CID 21143558).
When tee_shm_register returns failure, the shm_input pointer is
invalid, should not free it. Same issue also exists on registering
shm_output.
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Signed-off-by: Ye Li <ye.li@nxp.com>
Signed-off-by: Peng Fan <peng.fan@nxp.com>
---
arch/arm/mach-imx/cmd_dek.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/arm/mach-imx/cmd_dek.c b/arch/arm/mach-imx/cmd_dek.c
index d77a49df86..0be9df521a 100644
--- a/arch/arm/mach-imx/cmd_dek.c
+++ b/arch/arm/mach-imx/cmd_dek.c
@@ -101,6 +101,7 @@ static int blob_encap_dek(u32 src_addr, u32 dst_addr, u32 len)
0x0, &shm_output);
if (ret < 0) {
printf("Cannot register output shared memory 0x%X\n", ret);
+ tee_shm_free(shm_input);
goto error;
}
@@ -122,11 +123,11 @@ static int blob_encap_dek(u32 src_addr, u32 dst_addr, u32 len)
if (ret < 0)
printf("Cannot generate Blob with PTA DEK Blob 0x%X\n", ret);
-error:
/* Free shared memory */
tee_shm_free(shm_input);
tee_shm_free(shm_output);
+error:
/* Close session */
ret = tee_close_session(dev, arg.session);
if (ret < 0)
--
2.39.5