Shared memory allocated by tee linux kernel driver is not zeroed out

[Machiry]

Looks like the shared memory allocated by linux tee driver (via IOCTL TEE_IOC_SHM_ALLOC) is not zeroed out.

I verified this by modifying tee_client_api.c for checking for non-null bytes in mmap memory in function: TEEC_AllocateSharedMemory.

This could be exploited to leak data.

Is there any reason why it is not Zeroed out? or Am i missing something?

[jenswi-linaro]

You're right, the shared memory should be zeroed out.

[jbech-linaro]

@Machiry would you mind create a patch and pull request for it (instructions)? If not, we will pick it up / fix it sooner or later (when depends on how important it is).

[Machiry]

Sure. I can submit a pull request in couple of days.

[jenswi-linaro]

When I send out v11 of the generic TEE driver patch set, I'll include this in the "tee: generic TEE subsystem" patch. Everything will be in my name as it's a single patch, I hope that's OK with you.

[jbech-linaro]

Patch has been merged, closing the issue.