[lvc-project] Patch "tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()" has been added to the 7.2-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()

to the 7.2-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tee-shm-reject-zero-sized-allocations-in-tee_dyn_shm_alloc_helper.patch
and it can be found in the queue-7.2 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From b7f925fd5226deb953c8dcdc9677d3fcc2717c00 Mon Sep 17 00:00:00 2001
From: Georgiy Osokin <g.osokin at auroraos.dev>
Date: Mon, 28 Sep 2026 17:31:13 +0300
Subject: tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()

From: Georgiy Osokin <g.osokin at auroraos.dev>

commit b7f925fd5226deb953c8dcdc9677d3fcc2717c00 upstream.

tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size
and passes it to alloc_pages_exact() without checking it. For size == 0
nr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is
documented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page
allocator then trips its order > MAX_PAGE_ORDER warning and fails the
allocation; on a panic_on_warn kernel that ends the boot.

This can be triggered by TEE_IOC_SHM_ALLOC with struct
tee_ioctl_shm_alloc_data where size is 0.

Reject a zero page count, as register_shm_helper() already does for the
register path.

Fixes: cf4441503e20 ("tee: optee: Move pool_op helper functions")
Cc: stable at vger.kernel.org
Cc: lvc-project at linuxtesting.org
Signed-off-by: Georgiy Osokin <g.osokin at auroraos.dev>
Reviewed-by: Sumit Garg <sumit.garg at oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander at oss.qualcomm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 drivers/tee/tee_shm.c |    4 ++++
 1 file changed, 4 insertions(+)

--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -343,6 +343,10 @@ int tee_dyn_shm_alloc_helper(struct tee_
 	unsigned int i;
 	int rc = 0;
 
+	/* get_order(0) is undefined and exceeds MAX_PAGE_ORDER. */
+	if (!nr_pages)
+		return -EINVAL;
+
 	/*
 	 * Ignore alignment since this is already going to be page aligned
 	 * and there's no need for any larger alignment.


Patches currently in stable-queue which might be from g.osokin at auroraos.dev are

queue-7.2/tee-shm-reject-zero-sized-allocations-in-tee_dyn_shm_alloc_helper.patch