From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A65BE4F5E0 for ; Mon, 23 Feb 2026 05:07:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771823245; cv=none; b=qiGVZ4cwu5a4dYJAMNxPL38DgHnF39Yb8jTc0F1CSohMcPYr5DoXdjL3y8VpDR9Nxhmq3CDto6nLgCsVpDe27m8Rc5TJb7YnZAZ5MjQndDIKnNUE0AesxpqwthTDMZk85wRzFexjxgmR/sPh+f00hOqD24f7Yf0zAEkjKc5oWf0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771823245; c=relaxed/simple; bh=9sirl/LJPi8U+FnNQv8H6dqOhBee+XQieB7AswojCiI=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=AA3U7HetT+BLHQ54XwNkdIFpZc4vX+mpciUOVoC0V2jO11asvPLeX5F5tC4+Q238gveJ2q2HeTcYiLsesk2imS54Sc8tOO05a+NJnC46wbMkXJb1Y6VztGPiKFgk41HWN1wlg83Pe5H6vLG9J0KrqudGnvpv5sk8KakP7vJCxog= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=XqLBwvG0; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="XqLBwvG0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B0CA2C116C6; Mon, 23 Feb 2026 05:07:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1771823245; bh=9sirl/LJPi8U+FnNQv8H6dqOhBee+XQieB7AswojCiI=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=XqLBwvG07QXi+ZBtqnZWIGitErhGSWf5bWPfRrGE8LjL3b2yByr0ahC5XRVw84ODy x4xq9cYqQIOBQDt7D3BHk9cG1OYPJtqJf17QCSa+ggsE9GMQbgkMcrtuEIgd9MEX6P eJ9/7JyWe5TwBHcdIaF1q3pjmFPNxj91HySVM9ANOm6jkOdBE4uIQcS2z8WMfh9YLz T5NZtNwMKCrmPEmY5cyReRXoLyVsRiADCAGvrkNEgAakRGJB3vY3XDdetDjnQcKoZq JTOCyKGMFLLXg2rDIy4zPzFSrKukE0OGHSIczrfeWbDayS/4+M98P4GQUp5RsbyyBu u7ZFXnyfVS6cw== Date: Mon, 23 Feb 2026 10:37:18 +0530 From: Sumit Garg To: Sven =?iso-8859-1?Q?P=FCschel?= Cc: op-tee@lists.trustedfirmware.org, jens.wiklander@linaro.org, vbabka@suse.cz, akpm@linux-foundation.org, willy@infradead.org, linux-kernel@vger.kernel.org, Sumit Garg , Marco Felsch , kernel@pengutronix.de Subject: Re: [RFT PATCH] tee: shm: Remove refcounting of kernel pages Message-ID: References: <20260213113317.1728769-1-sumit.garg@kernel.org> <7546a4ff-485c-4473-999c-08fdf4e815bc@pengutronix.de> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-1 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <7546a4ff-485c-4473-999c-08fdf4e815bc@pengutronix.de> On Tue, Feb 17, 2026 at 12:01:55PM +0100, Sven Püschel wrote: > Hi Sumit, > > On 2/13/26 12:33 PM, Sumit Garg wrote: > > From: Sumit Garg > > > > Earlier TEE subsystem assumed to refcount all the memory pages to be > > shared with TEE implementation to be refcounted. However, the slab > > allocations within the kernel don't allow refcounting kernel pages. > > > > It is rather better to trust the kernel clients to not free pages while > > being shared with TEE implementation. Hence, remove refcounting of kernel > > pages from register_shm_helper() API. > > > > Fixes: b9c0e49abfca ("mm: decline to manipulate the refcount on a slab page") > > Reported-by: Marco Felsch > > Reported-by: Sven Püschel > > Suggested-by: Matthew Wilcox > > Signed-off-by: Sumit Garg > > --- > > drivers/tee/tee_shm.c | 29 +---------------------------- > > 1 file changed, 1 insertion(+), 28 deletions(-) > > > > diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c > > index 4a47de4bb2e5..54e2ba3afb25 100644 > > --- a/drivers/tee/tee_shm.c > > +++ b/drivers/tee/tee_shm.c > > @@ -23,29 +23,11 @@ struct tee_shm_dma_mem { > > struct page *page; > > }; > > -static void shm_put_kernel_pages(struct page **pages, size_t page_count) > > -{ > > - size_t n; > > - > > - for (n = 0; n < page_count; n++) > > - put_page(pages[n]); > > -} > > - > > -static void shm_get_kernel_pages(struct page **pages, size_t page_count) > > -{ > > - size_t n; > > - > > - for (n = 0; n < page_count; n++) > > - get_page(pages[n]); > > -} > > - > > static void release_registered_pages(struct tee_shm *shm) > > { > > if (shm->pages) { > > if (shm->flags & TEE_SHM_USER_MAPPED) > > unpin_user_pages(shm->pages, shm->num_pages); > > - else > > - shm_put_kernel_pages(shm->pages, shm->num_pages); > > kfree(shm->pages); > > } > > @@ -477,13 +459,6 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags, > > goto err_put_shm_pages; > > } > > - /* > > - * iov_iter_extract_kvec_pages does not get reference on the pages, > > - * get a reference on them. > > - */ > > - if (iov_iter_is_kvec(iter)) > > - shm_get_kernel_pages(shm->pages, num_pages); > > - > > shm->offset = off; > > shm->size = len; > > shm->num_pages = num_pages; > > @@ -497,10 +472,8 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags, > > return shm; > > err_put_shm_pages: > > - if (!iov_iter_is_kvec(iter)) > > + if (iter_is_uvec(iter)) > > I've replaced (due to compile failures noted by the kernel test robot) this > with the compiler suggested iter_is_iovec . I haven't checked, if this is > the correct fix. > > With this patch applied (on the upstream commit 970296997869), my reported > stacktrace/warning doesn't occur anymore. I didn't do any extensive testing, > but creating and using a trusted key with keyctl worked fine in my short > test. Thanks for testing it out, I have fixed the compiler error in v2 here [1]. Can you help to retest with a proper tested by tag? [1] https://lore.kernel.org/all/20260220084959.1966771-1-sumit.garg@kernel.org/ -Sumit > > Sincerely >     Sven > > > unpin_user_pages(shm->pages, shm->num_pages); > > - else > > - shm_put_kernel_pages(shm->pages, shm->num_pages); > > err_free_shm_pages: > > kfree(shm->pages); > > err_free_shm: