From nobody Thu Apr 2 20:28:01 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 15FF53EBF10 for ; Fri, 13 Feb 2026 11:33:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770982421; cv=none; b=MvHQsiGEay7sDr7wkD2EZpBp0SmGypzXSe7OzhpzE7QakrL48idH7qgDgBKrbDgaRQHgFNvWPfakEzzKGW/5WDirU1d1G8IoI02Nv1MT12V4mP580F75T9DyjtspSYMwVTuDTDDNhL5BXFxIL9Sh+LWMEMQL57d9VE9kOvxP72s= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770982421; c=relaxed/simple; bh=ZAsIAHTH8afGKBP3w79TsYREK8opIrY7trwWGRrtKZk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=Uljh8eBChfSMIzSA6WipOMtv+9Dzk59E7OuXkY43hPwlR8SonK1YjWZtxPxagZtiqRuS3EMS3QFL8vRXSNYTSNjHsNl3VszCqeFaj8URW78qVGdrE8C/Hc7EtFOD2ddewJi8qm9SPL11GoXp6TBLcWZll2qDlxsc6aosMxYsANQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=N9x0Ntlr; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="N9x0Ntlr" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 96E8EC116C6; Fri, 13 Feb 2026 11:33:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1770982420; bh=ZAsIAHTH8afGKBP3w79TsYREK8opIrY7trwWGRrtKZk=; h=From:To:Cc:Subject:Date:From; b=N9x0NtlrXjdEMuXYaJQpa5jL0/PlQRrK9EeiWBY93T1JNNF57/ESsuHoET1KXVcTl CY20zpX186kwJPksFI+7n5OHiZ4aZpPYVAhgV4XaRVOq8QauMmQ+61yuN8qPDVyS/F rGQ1hWFeoW8BUzeOkPZDVwfnJRmsnAZOvBtS4e0Ck44ymQg6z4eVk2q2ezVu9fKJ4N Dhqf/x909B0yTWWbspJLYqvza+y/ynmeK2KWnhd6pbs9NVAlehH08+23831xTYTHAa WQHIkrkvJ0KG83olBgFtuao+2uVN6dM+Xkh6HFkvyV6FMttE8n2eYCuh24rBXJQUuX r7QQnCUQ+oiFw== From: Sumit Garg To: op-tee@lists.trustedfirmware.org Cc: jens.wiklander@linaro.org, vbabka@suse.cz, akpm@linux-foundation.org, willy@infradead.org, linux-kernel@vger.kernel.org, Sumit Garg , Marco Felsch , =?UTF-8?q?Sven=20P=C3=BCschel?= Subject: [RFT PATCH] tee: shm: Remove refcounting of kernel pages Date: Fri, 13 Feb 2026 17:03:17 +0530 Message-ID: <20260213113317.1728769-1-sumit.garg@kernel.org> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Sumit Garg Earlier TEE subsystem assumed to refcount all the memory pages to be shared with TEE implementation to be refcounted. However, the slab allocations within the kernel don't allow refcounting kernel pages. It is rather better to trust the kernel clients to not free pages while being shared with TEE implementation. Hence, remove refcounting of kernel pages from register_shm_helper() API. Fixes: b9c0e49abfca ("mm: decline to manipulate the refcount on a slab page= ") Reported-by: Marco Felsch Reported-by: Sven P=C3=BCschel Suggested-by: Matthew Wilcox Signed-off-by: Sumit Garg --- drivers/tee/tee_shm.c | 29 +---------------------------- 1 file changed, 1 insertion(+), 28 deletions(-) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 4a47de4bb2e5..54e2ba3afb25 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -23,29 +23,11 @@ struct tee_shm_dma_mem { struct page *page; }; =20 -static void shm_put_kernel_pages(struct page **pages, size_t page_count) -{ - size_t n; - - for (n =3D 0; n < page_count; n++) - put_page(pages[n]); -} - -static void shm_get_kernel_pages(struct page **pages, size_t page_count) -{ - size_t n; - - for (n =3D 0; n < page_count; n++) - get_page(pages[n]); -} - static void release_registered_pages(struct tee_shm *shm) { if (shm->pages) { if (shm->flags & TEE_SHM_USER_MAPPED) unpin_user_pages(shm->pages, shm->num_pages); - else - shm_put_kernel_pages(shm->pages, shm->num_pages); =20 kfree(shm->pages); } @@ -477,13 +459,6 @@ register_shm_helper(struct tee_context *ctx, struct io= v_iter *iter, u32 flags, goto err_put_shm_pages; } =20 - /* - * iov_iter_extract_kvec_pages does not get reference on the pages, - * get a reference on them. - */ - if (iov_iter_is_kvec(iter)) - shm_get_kernel_pages(shm->pages, num_pages); - shm->offset =3D off; shm->size =3D len; shm->num_pages =3D num_pages; @@ -497,10 +472,8 @@ register_shm_helper(struct tee_context *ctx, struct io= v_iter *iter, u32 flags, =20 return shm; err_put_shm_pages: - if (!iov_iter_is_kvec(iter)) + if (iter_is_uvec(iter)) unpin_user_pages(shm->pages, shm->num_pages); - else - shm_put_kernel_pages(shm->pages, shm->num_pages); err_free_shm_pages: kfree(shm->pages); err_free_shm: --=20 2.51.0