[PATCH] tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()

[PATCH] tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()

[Georgiy Osokin]

tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size
and passes it to alloc_pages_exact() without checking it. For size == 0
nr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is
documented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page
allocator then trips its order > MAX_PAGE_ORDER warning and fails the
allocation; on a panic_on_warn kernel that ends the boot.

This can be triggered by TEE_IOC_SHM_ALLOC with struct
tee_ioctl_shm_alloc_data where size is 0.

Reject a zero page count, as register_shm_helper() already does for the
register path.

Fixes: cf4441503e20 ("tee: optee: Move pool_op helper functions")
Cc: stable@vger.kernel.org
Cc: lvc-project@linuxtesting.org
Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
---
 drivers/tee/tee_shm.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
index 6742b3579..daa4af1e0 100644
--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -343,6 +343,10 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align,
 	unsigned int i;
 	int rc = 0;
 
+	/* get_order(0) is undefined and exceeds MAX_PAGE_ORDER. */
+	if (!nr_pages)
+		return -EINVAL;
+
 	/*
 	 * Ignore alignment since this is already going to be page aligned
 	 * and there's no need for any larger alignment.

base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
-- 
2.54.0

Re: [PATCH] tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()

[Sumit Garg]

On Mon, 28 Sep 2026 at 17:31:13 +0300, Georgiy Osokin wrote:
>tee_dyn_shm_alloc_helper() derives nr_pages from a caller-supplied size
>and passes it to alloc_pages_exact() without checking it. For size == 0
>nr_pages is 0, and alloc_pages_exact(0) calls get_order(0), which is
>documented as undefined and returns BITS_PER_LONG - PAGE_SHIFT. The page
>allocator then trips its order > MAX_PAGE_ORDER warning and fails the
>allocation; on a panic_on_warn kernel that ends the boot.
>
>This can be triggered by TEE_IOC_SHM_ALLOC with struct
>tee_ioctl_shm_alloc_data where size is 0.
>
>Reject a zero page count, as register_shm_helper() already does for the
>register path.
>
>Fixes: cf4441503e20 ("tee: optee: Move pool_op helper functions")
>Cc: stable@vger.kernel.org
>Cc: lvc-project@linuxtesting.org
>Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
>---
> drivers/tee/tee_shm.c | 4 ++++
> 1 file changed, 4 insertions(+)

Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

-Sumit

>
>diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
>index 6742b3579..daa4af1e0 100644
>--- a/drivers/tee/tee_shm.c
>+++ b/drivers/tee/tee_shm.c
>@@ -343,6 +343,10 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align,
> 	unsigned int i;
> 	int rc = 0;
>
>+	/* get_order(0) is undefined and exceeds MAX_PAGE_ORDER. */
>+	if (!nr_pages)
>+		return -EINVAL;
>+
> 	/*
> 	 * Ignore alignment since this is already going to be page aligned
> 	 * and there's no need for any larger alignment.
>
>base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
>-- 
>2.54.0
>