[lvc-project] [PATCH] tee: shm: don't warn on an oversized page array in register_shm_helper()

[Jens Wiklander]

Hi,

On Fri, Oct 23, 2026 at 11:03 PM Georgiy Osokin <g.osokin at auroraos.dev> wrote:
>
> register_shm_helper() sizes shm->pages from the length passed to
> TEE_IOC_SHM_REGISTER and allocates it with kzalloc_objs(). A length above
> 2 GiB makes the array larger than the page allocator can serve in one
> block (MAX_PAGE_ORDER), so it trips its order warning; on a panic_on_warn
> kernel that is a panic.
>
> The size comes from userspace and the request fails with -ENOMEM anyway,
> so pass __GFP_NOWARN. kvzalloc_objs() would not help since kvmalloc
> warns above INT_MAX as well.
>
> Fixes: 033ddf12bcf5 ("tee: add register user memory")
> Cc: stable at vger.kernel.org
> Cc: lvc-project at linuxtesting.org
> Signed-off-by: Georgiy Osokin <g.osokin at auroraos.dev>
> ---
>  drivers/tee/tee_shm.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
> index 6742b35..d539988 100644
> --- a/drivers/tee/tee_shm.c
> +++ b/drivers/tee/tee_shm.c
> @@ -438,7 +438,8 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
>                 goto err_free_shm;
>         }
>
> -       shm->pages = kzalloc_objs(*shm->pages, num_pages);
> +       shm->pages = kzalloc_objs(*shm->pages, num_pages,
> +                                 GFP_KERNEL | __GFP_NOWARN);
>         if (!shm->pages) {
>                 ret = ERR_PTR(-ENOMEM);
>                 goto err_free_shm;
>
> base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
> --
> 2.54.0
>

Looks good. Sumit, do you agree?

Cheers,
Jens