Re: [RFT PATCH v2] tee: shm: Remove refcounting of kernel pages

On 2/20/26 9:49 AM, Sumit Garg wrote:

> From: Matthew Wilcox <[email protected]>
>
> Earlier TEE subsystem assumed to refcount all the memory pages to be
> shared with TEE implementation to be refcounted. However, the slab
> allocations within the kernel don't allow refcounting kernel pages.
>
> It is rather better to trust the kernel clients to not free pages while
> being shared with TEE implementation. Hence, remove refcounting of kernel
> pages from register_shm_helper() API.
>
> Fixes: b9c0e49abfca ("mm: decline to manipulate the refcount on a slab page")
> Reported-by: Marco Felsch <[email protected]>
> Reported-by: Sven Püschel <[email protected]>
> Signed-off-by: Matthew Wilcox <[email protected]>
> Co-developed-by: Sumit Garg <[email protected]>
> Signed-off-by: Sumit Garg <[email protected]>

Tested-by: Sven Püschel <[email protected]>

tested with a30b36143a41 ("Linux 6.19.4") and removed my reported 
warning stacktrace.

Sincerely
     Sven

> ---
>
> Changes in v2:
> - Attribute Matthew as the author of this patch.
> - Fix check for user pages.
>
>   drivers/tee/tee_shm.c | 27 ---------------------------
>   1 file changed, 27 deletions(-)
>
> diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
> index 4a47de4bb2e5..898707ca21a8 100644
> --- a/drivers/tee/tee_shm.c
> +++ b/drivers/tee/tee_shm.c
> @@ -23,29 +23,11 @@ struct tee_shm_dma_mem {
>   	struct page *page;
>   };
>   
> -static void shm_put_kernel_pages(struct page **pages, size_t page_count)
> -{
> -	size_t n;
> -
> -	for (n = 0; n < page_count; n++)
> -		put_page(pages[n]);
> -}
> -
> -static void shm_get_kernel_pages(struct page **pages, size_t page_count)
> -{
> -	size_t n;
> -
> -	for (n = 0; n < page_count; n++)
> -		get_page(pages[n]);
> -}
> -
>   static void release_registered_pages(struct tee_shm *shm)
>   {
>   	if (shm->pages) {
>   		if (shm->flags & TEE_SHM_USER_MAPPED)
>   			unpin_user_pages(shm->pages, shm->num_pages);
> -		else
> -			shm_put_kernel_pages(shm->pages, shm->num_pages);
>   
>   		kfree(shm->pages);
>   	}
> @@ -477,13 +459,6 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
>   		goto err_put_shm_pages;
>   	}
>   
> -	/*
> -	 * iov_iter_extract_kvec_pages does not get reference on the pages,
> -	 * get a reference on them.
> -	 */
> -	if (iov_iter_is_kvec(iter))
> -		shm_get_kernel_pages(shm->pages, num_pages);
> -
>   	shm->offset = off;
>   	shm->size = len;
>   	shm->num_pages = num_pages;
> @@ -499,8 +474,6 @@ register_shm_helper(struct tee_context *ctx, struct iov_iter *iter, u32 flags,
>   err_put_shm_pages:
>   	if (!iov_iter_is_kvec(iter))
>   		unpin_user_pages(shm->pages, shm->num_pages);
> -	else
> -		shm_put_kernel_pages(shm->pages, shm->num_pages);
>   err_free_shm_pages:
>   	kfree(shm->pages);
>   err_free_shm: