Path: csiph.com!eternal-september.org!feeder.eternal-september.org!aioe.org!bofh.it!news.nic.it!robomod From: Michal Hocko Newsgroups: linux.kernel Subject: Re: usb/gadget: warning in ep_write_iter/__alloc_pages_nodemask Date: Mon, 12 Dec 2016 22:10:02 +0100 Message-ID: References: X-Original-To: Andrey Konovalov X-Google-Dkim-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:to:cc:subject:message-id:references :mime-version:content-disposition:in-reply-to:user-agent; bh=p9DWIWzpuSRM0IbxuTGdg/CNhOHEPsIeGxBPkjDi10k=; b=CYsrTUq5u5YnN88mFw4SLvuPL/B2Vlqef18iLu9geNhvbSKnakNpWgnZ+JOaF08CKz qOYfDOTBzkCoId769tugCngzb2UxoW8S2sE3sloU9K6Ayqq3zR4GkFwTW+RExomBzprf CQbY/EaeJW7gPu48UH3Eu/cUarbhkl5wQVP0cKhasIlF2NBGkwFrGKx6Kiqo/hXN/Pfb H5Ye6hKRD1y00AxWFxjII6gN3r7F9RKbgqy0q3e28LrtHKSwXyqtja4FbpONCYV1JER1 aBcIOJ0xwfvThIS8dN+5/sywlexSqRzVLtvC4hrCfBJbYLBaETYRb1V8A3nGPFOIJ5jV QomQ== X-Gm-Message-State: AKaTC00QwePdwf4GY7j5KSPdEXHbpFGCyQJapM9xJ4/fV8SoTdr+QLojeQls3tQZOukRUQ== X-Received: by 10.28.230.197 with SMTP id e66mr20500682wmi.12.1481576706441; Mon, 12 Dec 2016 13:05:06 -0800 (PST) MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.6.0 (2016-04-01) Sender: robomod@news.nic.it List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Approved: robomod@news.nic.it Lines: 66 Organization: linux.* mail to news gateway X-Original-Cc: Felipe Balbi , Greg Kroah-Hartman , Al Viro , Marek Szyprowski , Deepa Dinamani , Mathieu Laurendeau , Bin Liu , USB list , LKML , Alan Stern , syzkaller , Dmitry Vyukov , Kostya Serebryany , Cristopher Lameter X-Original-Date: Mon, 12 Dec 2016 22:05:04 +0100 X-Original-Message-ID: <20161212210504.GB3107@dhcp22.suse.cz> X-Original-References: X-Original-Sender: linux-kernel-owner@vger.kernel.org Xref: csiph.com linux.kernel:1540661 On Mon 12-12-16 21:32:35, Andrey Konovalov wrote: > On Mon, Dec 12, 2016 at 9:31 PM, Andrey Konovalov wrote: > > Hi! > > > > While running the syzkaller fuzzer I've got the following error report. > > > > The issue is that the len argument is not checked for being too big. Well, the value is checked in kmalloc_slab. There is a discrepancy though. While the page allocator enforces order < MAX_ORDER, slab allocators enforce size <= KMALLOC_MAX_SIZE and KMALLOC_MAX_SIZE is 1UL << (MAX_ORDER + PAGE_SHIFT) for SLUB which is what I expect you have or 1UL << (MAX_ORDER + PAGE_SHIFT - 1) for SLAB on most archs. This means that KMALLOC_MAX_SIZE might be MAX_ORDER for SLUB which would explain your warning. Let's CC Christoph, this is nothing really new, but I suspect that SLUB should change the maximum size to something like SLAB does. That being said, what ep_write_iter does sounds quite stupit. It just allocates a large continuous buffer which seems to be under user control... Aka no good! It should do that per pages or something like that. Something worth fixing > > WARNING: CPU: 1 PID: 9935 at mm/page_alloc.c:3511 > > __alloc_pages_nodemask+0x159c/0x1e20 > > Kernel panic - not syncing: panic_on_warn set ... > > > > CPU: 1 PID: 9935 Comm: syz-executor0 Not tainted 4.9.0-rc7+ #34 > > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 > > ffff88006949f2c8 ffffffff81f96b8a ffffffff00000200 1ffff1000d293dec > > ffffed000d293de4 0000000000000a06 0000000041b58ab3 ffffffff8598b510 > > ffffffff81f968f8 0000000041b58ab3 ffffffff85942a58 ffffffff81432860 > > Call Trace: > > [< inline >] __dump_stack lib/dump_stack.c:15 > > [] dump_stack+0x292/0x398 lib/dump_stack.c:51 > > [] panic+0x1cb/0x3a9 kernel/panic.c:179 > > [] __warn+0x1c4/0x1e0 kernel/panic.c:542 > > [] warn_slowpath_null+0x2c/0x40 kernel/panic.c:585 > > [< inline >] __alloc_pages_slowpath mm/page_alloc.c:3511 > > [] __alloc_pages_nodemask+0x159c/0x1e20 mm/page_alloc.c:3781 > > [] alloc_pages_current+0x1c7/0x6b0 mm/mempolicy.c:2072 > > [< inline >] alloc_pages include/linux/gfp.h:469 > > [] kmalloc_order+0x1f/0x70 mm/slab_common.c:1015 > > [] kmalloc_order_trace+0x1f/0x160 mm/slab_common.c:1026 > > [< inline >] kmalloc_large include/linux/slab.h:422 > > [] __kmalloc+0x210/0x2d0 mm/slub.c:3723 > > [< inline >] kmalloc include/linux/slab.h:495 > > [] ep_write_iter+0x167/0xb50 > > drivers/usb/gadget/legacy/inode.c:664 > > [< inline >] new_sync_write fs/read_write.c:499 > > [] __vfs_write+0x483/0x760 fs/read_write.c:512 > > [] vfs_write+0x170/0x4e0 fs/read_write.c:560 > > [< inline >] SYSC_write fs/read_write.c:607 > > [] SyS_write+0xfb/0x230 fs/read_write.c:599 > > [] entry_SYSCALL_64_fastpath+0x1f/0xc2 > > Dumping ftrace buffer: > > (ftrace buffer empty) > > Kernel Offset: disabled > > +syzkaller -- Michal Hocko SUSE Labs