# git rev-parse -q --verify 573ae4f13f630d6660008f1974c0a8a29c30e18a^{commit}
573ae4f13f630d6660008f1974c0a8a29c30e18a
already have revision, skipping fetch
# git checkout -q -f -B kisskb 573ae4f13f630d6660008f1974c0a8a29c30e18a
# git clean -qxdf
# < git log -1
# commit 573ae4f13f630d6660008f1974c0a8a29c30e18a
# Author: Jens Wiklander <jens.wiklander@linaro.org>
# Date:   Thu Aug 18 13:08:59 2022 +0200
# 
#     tee: add overflow check in register_shm_helper()
#     
#     With special lengths supplied by user space, register_shm_helper() has
#     an integer overflow when calculating the number of pages covered by a
#     supplied user space memory region.
#     
#     This causes internal_get_user_pages_fast() a helper function of
#     pin_user_pages_fast() to do a NULL pointer dereference:
#     
#       Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010
#       Modules linked in:
#       CPU: 1 PID: 173 Comm: optee_example_a Not tainted 5.19.0 #11
#       Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015
#       pc : internal_get_user_pages_fast+0x474/0xa80
#       Call trace:
#        internal_get_user_pages_fast+0x474/0xa80
#        pin_user_pages_fast+0x24/0x4c
#        register_shm_helper+0x194/0x330
#        tee_shm_register_user_buf+0x78/0x120
#        tee_ioctl+0xd0/0x11a0
#        __arm64_sys_ioctl+0xa8/0xec
#        invoke_syscall+0x48/0x114
#     
#     Fix this by adding an an explicit call to access_ok() in
#     tee_shm_register_user_buf() to catch an invalid user space address
#     early.
#     
#     Fixes: 033ddf12bcf5 ("tee: add register user memory")
#     Cc: stable@vger.kernel.org
#     Reported-by: Nimish Mishra <neelam.nimish@gmail.com>
#     Reported-by: Anirban Chakraborty <ch.anirban00727@gmail.com>
#     Reported-by: Debdeep Mukhopadhyay <debdeep.mukhopadhyay@gmail.com>
#     Suggested-by: Jerome Forissier <jerome.forissier@linaro.org>
#     Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
#     Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
# < /opt/cross/kisskb/korg/gcc-8.5.0-nolibc/xtensa-linux/bin/xtensa-linux-gcc --version
# < /opt/cross/kisskb/korg/gcc-8.5.0-nolibc/xtensa-linux/bin/xtensa-linux-ld --version
# < git log --format=%s --max-count=1 573ae4f13f630d6660008f1974c0a8a29c30e18a
# < make -s -j 48 ARCH=xtensa O=/kisskb/build/linus_xtensa-defconfig_xtensa-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.5.0-nolibc/xtensa-linux/bin/xtensa-linux-  defconfig
# < make -s -j 48 ARCH=xtensa O=/kisskb/build/linus_xtensa-defconfig_xtensa-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.5.0-nolibc/xtensa-linux/bin/xtensa-linux-  help
# make -s -j 48 ARCH=xtensa O=/kisskb/build/linus_xtensa-defconfig_xtensa-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.5.0-nolibc/xtensa-linux/bin/xtensa-linux-  olddefconfig
# make -s -j 48 ARCH=xtensa O=/kisskb/build/linus_xtensa-defconfig_xtensa-gcc8 CROSS_COMPILE=/opt/cross/kisskb/korg/gcc-8.5.0-nolibc/xtensa-linux/bin/xtensa-linux-  
Completed OK
# rm -rf /kisskb/build/linus_xtensa-defconfig_xtensa-gcc8
# Build took: 0:00:35.615898