[PATCH] firmware: arm_scmi: optee: Check return value of tee_shm_get_va()

[Chen Ni]

The function tee_shm_get_va() can return an error pointer if the shared
memory is not properly mapped or if the offset is invalid. Without this
check, passing the error pointer to subsequent memory operations could
lead to a kernel panic.

Add a check for IS_ERR() on the return value of tee_shm_get_va().

Fixes: db9cc5e67778 ("firmware: arm_scmi: Make OPTEE transport a standalone driver")
Signed-off-by: Chen Ni <nichen at iscas.ac.cn>
---
 drivers/firmware/arm_scmi/transports/optee.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/firmware/arm_scmi/transports/optee.c b/drivers/firmware/arm_scmi/transports/optee.c
index 07ae18d5279d..a6774152c205 100644
--- a/drivers/firmware/arm_scmi/transports/optee.c
+++ b/drivers/firmware/arm_scmi/transports/optee.c
@@ -340,6 +340,13 @@ static int setup_dynamic_shmem(struct device *dev, struct scmi_optee_channel *ch
 	}
 
 	shbuf = tee_shm_get_va(channel->tee_shm, 0);
+	if (IS_ERR(shbuf)) {
+		dev_err(channel->cinfo->dev, "failed to get shared memory VA\n");
+		tee_shm_free(channel->tee_shm);
+		channel->tee_shm = NULL;
+		return PTR_ERR(shbuf);
+	}
+
 	memset(shbuf, 0, msg_size);
 	channel->req.msg = shbuf;
 	channel->rx_len = msg_size;
-- 
2.25.1