linux-kernel - Re: usb: memory allocation WARNING in hcd_buffer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Tue, 5 Jul 2016 17:58:36 +0200
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	Alan Stern <stern@...land.harvard.edu>
Cc:	Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
	Vegard Nossum <vegard.nossum@...cle.com>,
	chunfeng.yun@...iatek.com, geert@...ux-m68k.org,
	USB list <linux-usb@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	syzkaller <syzkaller@...glegroups.com>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>
Subject: Re: usb: memory allocation WARNING in hcd_buffer_alloc

On Tue, Jul 5, 2016 at 5:42 PM, Alan Stern <stern@...land.harvard.edu> wrote:
> On Tue, 5 Jul 2016, Dmitry Vyukov wrote:
>
>> Hello,
>>
>> The following program trigger the following WARNING:
>>
>> ------------[ cut here ]------------
>> WARNING: CPU: 0 PID: 6263 at mm/page_alloc.c:3584[<     inline     >]
>> __alloc_pages_slowpath mm/page_alloc.c:3584
>> WARNING: CPU: 0 PID: 6263 at mm/page_alloc.c:3584[<      none      >]
>> __alloc_pages_nodemask+0x1731/0x2350 mm/page_alloc.c:3854
>> Modules linked in:
>> CPU: 0 PID: 6263 Comm: a.out Not tainted 4.7.0-rc5+ #28
>> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
>>  ffffffff880b58e0 ffff88006ad3f778 ffffffff82cc01af ffffffff86cf92c0
>>  fffffbfff1016b1c 0000000000000000 0000000000000000 ffffffff86cf92c0
>>  ffffffff816b7881 0000000000000009 ffff88006ad3f7c0 ffffffff8136d17f
>> Call Trace:
>>  [<     inline     >] __dump_stack lib/dump_stack.c:15
>>  [<ffffffff82cc01af>] dump_stack+0x12e/0x18f lib/dump_stack.c:51
>>  [<ffffffff8136d17f>] __warn+0x19f/0x1e0 kernel/panic.c:516
>>  [<ffffffff8136d38c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:551
>>  [<     inline     >] __alloc_pages_slowpath mm/page_alloc.c:3584
>>  [<ffffffff816b7881>] __alloc_pages_nodemask+0x1731/0x2350 mm/page_alloc.c:3854
>>  [<     inline     >] __alloc_pages include/linux/gfp.h:432
>>  [<     inline     >] __alloc_pages_node include/linux/gfp.h:445
>>  [<     inline     >] alloc_pages_node include/linux/gfp.h:459
>>  [<ffffffff8120b28f>] dma_generic_alloc_coherent+0xff/0x250
>> arch/x86/kernel/pci-dma.c:102
>>  [<     inline     >] dma_alloc_attrs include/linux/dma-mapping.h:374
>>  [<     inline     >] dma_alloc_coherent include/linux/dma-mapping.h:401
>>  [<ffffffff84699f1d>] hcd_buffer_alloc+0x1dd/0x400 drivers/usb/core/buffer.c:140
>>  [<ffffffff8465a670>] usb_alloc_coherent+0x60/0x80 drivers/usb/core/usb.c:740
>>  [<ffffffff846a12ba>] usbdev_mmap+0x19a/0x650 drivers/usb/core/devio.c:244
>>  [<ffffffff8175ae2f>] mmap_region+0x87f/0xfe0 mm/mmap.c:1507
>>  [<ffffffff8175bf2d>] do_mmap+0x99d/0xbf0 mm/mmap.c:1286
>>  [<     inline     >] do_mmap_pgoff include/linux/mm.h:2005
>>  [<ffffffff81701e66>] vm_mmap_pgoff+0x156/0x1a0 mm/util.c:302
>>  [<     inline     >] SYSC_mmap_pgoff mm/mmap.c:1336
>>  [<ffffffff81754dea>] SyS_mmap_pgoff+0x34a/0x580 mm/mmap.c:1294
>>  [<     inline     >] SYSC_mmap arch/x86/kernel/sys_x86_64.c:95
>>  [<ffffffff81208ff6>] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:86
>>  [<ffffffff86a94e00>] entry_SYSCALL_64_fastpath+0x23/0xc1
>> arch/x86/entry/entry_64.S:207
>> ---[ end trace 94402e12bc6578e5 ]---
>>
>> // autogenerated by syzkaller (http://github.com/google/syzkaller)
>> #include <pthread.h>
>> #include <stdint.h>
>> #include <string.h>
>> #include <sys/syscall.h>
>> #include <unistd.h>
>> #include <sys/mman.h>
>>
>> int main()
>> {
>>   int fd = open("/dev/bus/usb/001/001", 0x800ul, 0);
>>   mmap((void*)0x201c4000ul, 0xc00000ul, 0x3ul, 0x20012ul, fd, 0x0ul);
>>   return 0;
>> }
>>
>> On commit 1a0a02d1efa066001fd315c1b4df583d939fa2c4 (Jun 30).
>
> This is an attempt to allocate 12 MB of coherent memory.  As far as I
> can tell, the WARNING refers to invalid bits set in the gfp_mask.
>
> However the original allocation comes from usbdev_mmap() in
> drivers/usb/core/devio.c:
>
>         mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle);
>
> I don't see how that ends up causing the WARNING.


There is also arch_dma_alloc_attrs on the way:

132 bool arch_dma_alloc_attrs(struct device **dev, gfp_t *gfp)
133 {
134         if (!*dev)
135                 *dev = &x86_dma_fallback_dev;
136
137         *gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
138         *gfp = dma_alloc_coherent_gfp_flags(*dev, *gfp);
139
140         if (!is_device_dma_capable(*dev))
141                 return false;
142         return true;
143
144 }
145 EXPORT_SYMBOL(arch_dma_alloc_attrs);