[PATCH] tee: shm: don't warn on an oversized page array in register_shm_helper()

[PATCH] tee: shm: don't warn on an oversized page array in register_shm_helper()

[Georgiy Osokin]

register_shm_helper() sizes shm->pages from the length passed to
TEE_IOC_SHM_REGISTER and allocates it with kzalloc_objs(). A length above
2 GiB makes the array larger than the page allocator can serve in one
block (MAX_PAGE_ORDER), so it trips its order warning; on a panic_on_warn
kernel that is a panic.

The size comes from userspace and the request fails with -ENOMEM anyway,
so pass __GFP_NOWARN. kvzalloc_objs() would not help since kvmalloc
warns above INT_MAX as well.

Fixes: 033ddf12bcf5 ("tee: add register user memory")
Cc: stable@vger.kernel.org
Cc: lvc-project@linuxtesting.org
Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
---
 drivers/tee/tee_shm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
index 6742b35..d539988 100644
--- a/drivers/tee/tee_shm.c
+++ b/drivers/tee/tee_shm.c
@@ -438,7 +438,8 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
 		goto err_free_shm;
 	}
 
-	shm->pages = kzalloc_objs(*shm->pages, num_pages);
+	shm->pages = kzalloc_objs(*shm->pages, num_pages,
+				  GFP_KERNEL | __GFP_NOWARN);
 	if (!shm->pages) {
 		ret = ERR_PTR(-ENOMEM);
 		goto err_free_shm;

base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
-- 
2.54.0

Re: [PATCH] tee: shm: don't warn on an oversized page array in register_shm_helper()

[Jens Wiklander]

Hi,

On Fri, Oct 23, 2026 at 11:03 PM Georgiy Osokin <g.osokin@auroraos.dev> wrote:
>
> register_shm_helper() sizes shm->pages from the length passed to
> TEE_IOC_SHM_REGISTER and allocates it with kzalloc_objs(). A length above
> 2 GiB makes the array larger than the page allocator can serve in one
> block (MAX_PAGE_ORDER), so it trips its order warning; on a panic_on_warn
> kernel that is a panic.
>
> The size comes from userspace and the request fails with -ENOMEM anyway,
> so pass __GFP_NOWARN. kvzalloc_objs() would not help since kvmalloc
> warns above INT_MAX as well.
>
> Fixes: 033ddf12bcf5 ("tee: add register user memory")
> Cc: stable@vger.kernel.org
> Cc: lvc-project@linuxtesting.org
> Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
> ---
>  drivers/tee/tee_shm.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
> index 6742b35..d539988 100644
> --- a/drivers/tee/tee_shm.c
> +++ b/drivers/tee/tee_shm.c
> @@ -438,7 +438,8 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
>                 goto err_free_shm;
>         }
>
> -       shm->pages = kzalloc_objs(*shm->pages, num_pages);
> +       shm->pages = kzalloc_objs(*shm->pages, num_pages,
> +                                 GFP_KERNEL | __GFP_NOWARN);
>         if (!shm->pages) {
>                 ret = ERR_PTR(-ENOMEM);
>                 goto err_free_shm;
>
> base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
> --
> 2.54.0
>

Looks good. Sumit, do you agree?

Cheers,
Jens

Re: [PATCH] tee: shm: don't warn on an oversized page array in register_shm_helper()

[Sumit Garg]

On Tue, 03 Nov 2026 at 19:34:08 +0100, Jens Wiklander wrote:
>Hi,
>
>On Fri, Oct 23, 2026 at 11:03 PM Georgiy Osokin <g.osokin@auroraos.dev> wrote:
>>
>> register_shm_helper() sizes shm->pages from the length passed to
>> TEE_IOC_SHM_REGISTER and allocates it with kzalloc_objs(). A length above
>> 2 GiB makes the array larger than the page allocator can serve in one
>> block (MAX_PAGE_ORDER), so it trips its order warning; on a panic_on_warn
>> kernel that is a panic.
>>
>> The size comes from userspace and the request fails with -ENOMEM anyway,
>> so pass __GFP_NOWARN. kvzalloc_objs() would not help since kvmalloc
>> warns above INT_MAX as well.
>>
>> Fixes: 033ddf12bcf5 ("tee: add register user memory")
>> Cc: stable@vger.kernel.org
>> Cc: lvc-project@linuxtesting.org
>> Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
>> ---
>>  drivers/tee/tee_shm.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
>> index 6742b35..d539988 100644
>> --- a/drivers/tee/tee_shm.c
>> +++ b/drivers/tee/tee_shm.c
>> @@ -438,7 +438,8 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
>>                 goto err_free_shm;
>>         }
>>
>> -       shm->pages = kzalloc_objs(*shm->pages, num_pages);
>> +       shm->pages = kzalloc_objs(*shm->pages, num_pages,
>> +                                 GFP_KERNEL | __GFP_NOWARN);
>>         if (!shm->pages) {
>>                 ret = ERR_PTR(-ENOMEM);
>>                 goto err_free_shm;
>>
>> base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
>> --
>> 2.54.0
>>
>
>Looks good. Sumit, do you agree?

Yeah, feel free to add:

Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

-Sumit

Re: [PATCH] tee: shm: don't warn on an oversized page array in register_shm_helper()

[Jens Wiklander]

On Thu, Nov 5, 2026 at 1:13 PM Sumit Garg <sumit.garg@kernel.org> wrote:
>
> On Tue, 03 Nov 2026 at 19:34:08 +0100, Jens Wiklander wrote:
> >Hi,
> >
> >On Fri, Oct 23, 2026 at 11:03 PM Georgiy Osokin <g.osokin@auroraos.dev> wrote:
> >>
> >> register_shm_helper() sizes shm->pages from the length passed to
> >> TEE_IOC_SHM_REGISTER and allocates it with kzalloc_objs(). A length above
> >> 2 GiB makes the array larger than the page allocator can serve in one
> >> block (MAX_PAGE_ORDER), so it trips its order warning; on a panic_on_warn
> >> kernel that is a panic.
> >>
> >> The size comes from userspace and the request fails with -ENOMEM anyway,
> >> so pass __GFP_NOWARN. kvzalloc_objs() would not help since kvmalloc
> >> warns above INT_MAX as well.
> >>
> >> Fixes: 033ddf12bcf5 ("tee: add register user memory")
> >> Cc: stable@vger.kernel.org
> >> Cc: lvc-project@linuxtesting.org
> >> Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
> >> ---
> >>  drivers/tee/tee_shm.c | 3 ++-
> >>  1 file changed, 2 insertions(+), 1 deletion(-)
> >>
> >> diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
> >> index 6742b35..d539988 100644
> >> --- a/drivers/tee/tee_shm.c
> >> +++ b/drivers/tee/tee_shm.c
> >> @@ -438,7 +438,8 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
> >>                 goto err_free_shm;
> >>         }
> >>
> >> -       shm->pages = kzalloc_objs(*shm->pages, num_pages);
> >> +       shm->pages = kzalloc_objs(*shm->pages, num_pages,
> >> +                                 GFP_KERNEL | __GFP_NOWARN);
> >>         if (!shm->pages) {
> >>                 ret = ERR_PTR(-ENOMEM);
> >>                 goto err_free_shm;
> >>
> >> base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e
> >> --
> >> 2.54.0
> >>
> >
> >Looks good. Sumit, do you agree?
>
> Yeah, feel free to add:
>
> Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>

I'm picking this up.

Cheers,
Jens