register_shm_helper() sizes shm->pages from the length passed to TEE_IOC_SHM_REGISTER and allocates it with kzalloc_objs(). A length above 2 GiB makes the array larger than the page allocator can serve in one block (MAX_PAGE_ORDER), so it trips its order warning; on a panic_on_warn kernel that is a panic.

The size comes from userspace and the request fails with -ENOMEM anyway, so pass __GFP_NOWARN. kvzalloc_objs() would not help since kvmalloc warns above INT_MAX as well.

Fixes: 033ddf12bcf5 ("tee: add register user memory") Cc: stable@vger.kernel.org Cc: lvc-project@linuxtesting.org Signed-off-by: Georgiy Osokin g.osokin@auroraos.dev --- drivers/tee/tee_shm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 6742b35..d539988 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -438,7 +438,8 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags, goto err_free_shm; }

- shm->pages = kzalloc_objs(*shm->pages, num_pages); + shm->pages = kzalloc_objs(*shm->pages, num_pages, + GFP_KERNEL | __GFP_NOWARN); if (!shm->pages) { ret = ERR_PTR(-ENOMEM); goto err_free_shm;

base-commit: 72d3fcf802c45d00b300f25b848a93c3a2bd7c7e