[lvc-project] [PATCH] tee: shm: don't warn on an oversized page array in register_shm_helper()

[Georgiy Osokin]

register_shm_helper() sizes shm->pages from the length passed to
TEE_IOC_SHM_REGISTER and allocates it with kzalloc_objs(). A length above
2 GiB makes the array larger than the page allocator can serve in one
block (MAX_PAGE_ORDER), so it trips its order warning; on a panic_on_warn
kernel that is a panic.

The size comes from userspace and the request fails with -ENOMEM anyway,
so pass __GFP_NOWARN. kvzalloc_objs() would not help since kvmalloc
warns above INT_MAX as well.

Fixes: 033ddf12bcf5 ("tee: add register user memory")
Cc: stable at vger.kernel.org
Cc: lvc-project at linuxtesting.org
Signed-off-by: Georgiy Osokin <g.osokin at auroraos.dev>
---
 drivers/tee/tee_shm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
index 6742b35..d539988 100644
--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -438,7 +438,8 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
 		goto err_free_shm;
 	}
 
-	shm->pages = kzalloc_objs(*shm->pages, num_pages);
+	shm->pages = kzalloc_objs(*shm->pages, num_pages,
+				  GFP_KERNEL | __GFP_NOWARN);
 	if (!shm->pages) {
 		ret = ERR_PTR(-ENOMEM);
 		goto err_free_shm;

base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
-- 
2.54.0