tee_dyn_shm_alloc_helper() passes the size from TEE_IOC_SHM_ALLOC to alloc_pages_exact(), which needs one physically contiguous block. A size above 4 MiB (MAX_PAGE_ORDER with 4 KiB pages) is more than the page allocator can serve, so it trips its order warning; on a panic_on_warn kernel that is a panic.

The size comes from userspace and the request fails with -ENOMEM anyway, so pass __GFP_NOWARN.

Fixes: abd135ba215c ("tee: optee: add optee-specific shared pool implementation") Cc: stable@vger.kernel.org Cc: lvc-project@linuxtesting.org Signed-off-by: Georgiy Osokin g.osokin@auroraos.dev --- v2: Fixes now points to abd135ba215c, the commit that introduced the unchecked allocation; cf4441503e20 only moved the code. v1: https://lore.kernel.org/all/20261026105209.161195-1-g.osokin@auroraos.dev/

drivers/tee/tee_shm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index daa4af1..8b117d6 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -352,7 +352,7 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align, * and there's no need for any larger alignment. */ shm->kaddr = alloc_pages_exact(nr_pages * PAGE_SIZE, - GFP_KERNEL | __GFP_ZERO); + GFP_KERNEL | __GFP_ZERO | __GFP_NOWARN); if (!shm->kaddr) return -ENOMEM;