* [syzbot] [mm?] WARNING in raw_ioctl
@ 2025-10-24 23:11 syzbot
2025-10-25 9:16 ` Gopi Krishna Menon
` (5 more replies)
0 siblings, 6 replies; 13+ messages in thread
From: syzbot @ 2025-10-24 23:11 UTC (permalink / raw)
To: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
linux-kernel, linux-mm, matthew.brost, rakie.kim, syzkaller-bugs,
ying.huang, ziy
Hello,
syzbot found the following issue on:
HEAD commit: 72fb0170ef1f Add linux-next specific files for 20251024
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=10fd0be2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=119eae7c580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140693e2580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/be1fa3d1f761/disk-72fb0170.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/57302bf7af40/vmlinux-72fb0170.xz
kernel image: https://storage.googleapis.com/syzbot-assets/91c806bb2a2b/bzImage-72fb0170.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
------------[ cut here ]------------
WARNING: mm/page_alloc.c:5190 at __alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190, CPU#1: syz.0.17/6001
Modules linked in:
CPU: 1 UID: 0 PID: 6001 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190
Code: 74 10 4c 89 e7 89 54 24 0c e8 64 b9 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 b1 7d 70 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24
RSP: 0018:ffffc90003017920 EFLAGS: 00010246
RAX: ffffc90003017900 RBX: 0000000000000013 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003017988
RBP: ffffc90003017a18 R08: ffffc90003017987 R09: 0000000000000000
R10: ffffc90003017960 R11: fffff52000602f31 R12: 0000000000000000
R13: 1ffff92000602f28 R14: 0000000000040cc0 R15: dffffc0000000000
FS: 000055558dedb500(0000) GS:ffff888125ddc000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffef4504a80 CR3: 0000000072ffa000 CR4: 00000000003526f0
Call Trace:
<TASK>
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2418
___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:5583
__kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5614
__do_kmalloc_node mm/slub.c:5630 [inline]
__kmalloc_noprof+0x4c9/0x800 mm/slub.c:5654
kmalloc_noprof include/linux/slab.h:961 [inline]
raw_alloc_io_data drivers/usb/gadget/legacy/raw_gadget.c:673 [inline]
raw_ioctl_ep_read drivers/usb/gadget/legacy/raw_gadget.c:1162 [inline]
raw_ioctl+0x18fb/0x3be0 drivers/usb/gadget/legacy/raw_gadget.c:1325
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fccefd8efc9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffef4505ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fcceffe5fa0 RCX: 00007fccefd8efc9
RDX: 00002000000000c0 RSI: 00000000c0085508 RDI: 0000000000000004
RBP: 00007fccefe11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fcceffe5fa0 R14: 00007fcceffe5fa0 R15: 0000000000000003
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [mm?] WARNING in raw_ioctl
2025-10-24 23:11 [syzbot] [mm?] WARNING in raw_ioctl syzbot
@ 2025-10-25 9:16 ` Gopi Krishna Menon
2025-10-25 10:25 ` syzbot
2025-10-25 13:02 ` Gopi Krishna Menon
` (4 subsequent siblings)
5 siblings, 1 reply; 13+ messages in thread
From: Gopi Krishna Menon @ 2025-10-25 9:16 UTC (permalink / raw)
To: syzbot
Cc: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
linux-kernel, linux-mm, matthew.brost, rakie.kim, syzkaller-bugs,
ying.huang, ziy
On Fri, Oct 24, 2025 at 04:11:28PM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 72fb0170ef1f Add linux-next specific files for 20251024
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=10fd0be2580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
> dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=119eae7c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140693e2580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/be1fa3d1f761/disk-72fb0170.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/57302bf7af40/vmlinux-72fb0170.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/91c806bb2a2b/bzImage-72fb0170.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> WARNING: mm/page_alloc.c:5190 at __alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190, CPU#1: syz.0.17/6001
> Modules linked in:
> CPU: 1 UID: 0 PID: 6001 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
> RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190
> Code: 74 10 4c 89 e7 89 54 24 0c e8 64 b9 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 b1 7d 70 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24
> RSP: 0018:ffffc90003017920 EFLAGS: 00010246
> RAX: ffffc90003017900 RBX: 0000000000000013 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003017988
> RBP: ffffc90003017a18 R08: ffffc90003017987 R09: 0000000000000000
> R10: ffffc90003017960 R11: fffff52000602f31 R12: 0000000000000000
> R13: 1ffff92000602f28 R14: 0000000000040cc0 R15: dffffc0000000000
> FS: 000055558dedb500(0000) GS:ffff888125ddc000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffef4504a80 CR3: 0000000072ffa000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2418
> ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:5583
> __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5614
> __do_kmalloc_node mm/slub.c:5630 [inline]
> __kmalloc_noprof+0x4c9/0x800 mm/slub.c:5654
> kmalloc_noprof include/linux/slab.h:961 [inline]
> raw_alloc_io_data drivers/usb/gadget/legacy/raw_gadget.c:673 [inline]
> raw_ioctl_ep_read drivers/usb/gadget/legacy/raw_gadget.c:1162 [inline]
> raw_ioctl+0x18fb/0x3be0 drivers/usb/gadget/legacy/raw_gadget.c:1325
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:597 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fccefd8efc9
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffef4505ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007fcceffe5fa0 RCX: 00007fccefd8efc9
> RDX: 00002000000000c0 RSI: 00000000c0085508 RDI: 0000000000000004
> RBP: 00007fccefe11f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fcceffe5fa0 R14: 00007fcceffe5fa0 R15: 0000000000000003
> </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
Lets first test with KMALLOC_MAX_SIZE as the upper bound for io->length
from userspace and then figure out the appropriate upper bound.
#syz test
diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index b71680c58de6..7b579a86c145 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -670,6 +670,8 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,
if (get_from_user)
data = memdup_user(ptr + sizeof(*io), io->length);
else {
+ if (io->length > KMALLOC_MAX_SIZE)
+ return ERR_PTR(-EINVAL);
data = kmalloc(io->length, GFP_KERNEL);
if (!data)
data = ERR_PTR(-ENOMEM);
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [mm?] WARNING in raw_ioctl
2025-10-25 9:16 ` Gopi Krishna Menon
@ 2025-10-25 10:25 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-10-25 10:25 UTC (permalink / raw)
To: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
krishnagopi487, linux-kernel, linux-mm, matthew.brost, rakie.kim,
syzkaller-bugs, ying.huang, ziy
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
Tested-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
Tested on:
commit: 72fb0170 Add linux-next specific files for 20251024
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=125cc258580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=13036e7c580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [mm?] WARNING in raw_ioctl
2025-10-24 23:11 [syzbot] [mm?] WARNING in raw_ioctl syzbot
2025-10-25 9:16 ` Gopi Krishna Menon
@ 2025-10-25 13:02 ` Gopi Krishna Menon
2025-10-25 13:15 ` syzbot
2025-10-25 13:20 ` Gopi Krishna Menon
` (3 subsequent siblings)
5 siblings, 1 reply; 13+ messages in thread
From: Gopi Krishna Menon @ 2025-10-25 13:02 UTC (permalink / raw)
To: syzbot
Cc: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
linux-kernel, linux-mm, matthew.brost, rakie.kim, syzkaller-bugs,
ying.huang, ziy
On Fri, Oct 24, 2025 at 04:11:28PM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 72fb0170ef1f Add linux-next specific files for 20251024
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=10fd0be2580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
> dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=119eae7c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140693e2580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/be1fa3d1f761/disk-72fb0170.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/57302bf7af40/vmlinux-72fb0170.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/91c806bb2a2b/bzImage-72fb0170.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> WARNING: mm/page_alloc.c:5190 at __alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190, CPU#1: syz.0.17/6001
> Modules linked in:
> CPU: 1 UID: 0 PID: 6001 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
> RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190
> Code: 74 10 4c 89 e7 89 54 24 0c e8 64 b9 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 b1 7d 70 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24
> RSP: 0018:ffffc90003017920 EFLAGS: 00010246
> RAX: ffffc90003017900 RBX: 0000000000000013 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003017988
> RBP: ffffc90003017a18 R08: ffffc90003017987 R09: 0000000000000000
> R10: ffffc90003017960 R11: fffff52000602f31 R12: 0000000000000000
> R13: 1ffff92000602f28 R14: 0000000000040cc0 R15: dffffc0000000000
> FS: 000055558dedb500(0000) GS:ffff888125ddc000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffef4504a80 CR3: 0000000072ffa000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2418
> ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:5583
> __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5614
> __do_kmalloc_node mm/slub.c:5630 [inline]
> __kmalloc_noprof+0x4c9/0x800 mm/slub.c:5654
> kmalloc_noprof include/linux/slab.h:961 [inline]
> raw_alloc_io_data drivers/usb/gadget/legacy/raw_gadget.c:673 [inline]
> raw_ioctl_ep_read drivers/usb/gadget/legacy/raw_gadget.c:1162 [inline]
> raw_ioctl+0x18fb/0x3be0 drivers/usb/gadget/legacy/raw_gadget.c:1325
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:597 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fccefd8efc9
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffef4505ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007fcceffe5fa0 RCX: 00007fccefd8efc9
> RDX: 00002000000000c0 RSI: 00000000c0085508 RDI: 0000000000000004
> RBP: 00007fccefe11f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fcceffe5fa0 R14: 00007fcceffe5fa0 R15: 0000000000000003
> </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
Since the maximum packet size of the endpoint descriptor is a 16 bit
field, we can make sure that the io->length is never greater than 65535
bytes.
#syz test
diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index b71680c58de6..00f5e697d321 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -667,6 +667,8 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,
return ERR_PTR(-EINVAL);
if (!usb_raw_io_flags_valid(io->flags))
return ERR_PTR(-EINVAL);
+ if (io->length > USB_RAW_IO_MAX_LENGTH)
+ return ERR_PTR(-EINVAL);
if (get_from_user)
data = memdup_user(ptr + sizeof(*io), io->length);
else {
diff --git a/include/uapi/linux/usb/raw_gadget.h b/include/uapi/linux/usb/raw_gadget.h
index f0224a8dc858..effe8a543c75 100644
--- a/include/uapi/linux/usb/raw_gadget.h
+++ b/include/uapi/linux/usb/raw_gadget.h
@@ -106,6 +106,9 @@ struct usb_raw_ep_io {
/* Maximum number of non-control endpoints in struct usb_raw_eps_info. */
#define USB_RAW_EPS_NUM_MAX 30
+/* Maximum length for raw endpoint IO */
+#define USB_RAW_IO_MAX_LENGTH 65535
+
/* Maximum length of UDC endpoint name in struct usb_raw_ep_info. */
#define USB_RAW_EP_NAME_MAX 16
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [mm?] WARNING in raw_ioctl
2025-10-25 13:02 ` Gopi Krishna Menon
@ 2025-10-25 13:15 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-10-25 13:15 UTC (permalink / raw)
To: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
krishnagopi487, linux-kernel, linux-mm, matthew.brost, rakie.kim,
syzkaller-bugs, ying.huang, ziy
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to apply patch:
checking file drivers/usb/gadget/legacy/raw_gadget.c
checking file include/uapi/linux/usb/raw_gadget.h
patch: **** unexpected end of file in patch
Tested on:
commit: 72fb0170 Add linux-next specific files for 20251024
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
compiler:
patch: https://syzkaller.appspot.com/x/patch.diff?x=16ea4be2580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [mm?] WARNING in raw_ioctl
2025-10-24 23:11 [syzbot] [mm?] WARNING in raw_ioctl syzbot
2025-10-25 9:16 ` Gopi Krishna Menon
2025-10-25 13:02 ` Gopi Krishna Menon
@ 2025-10-25 13:20 ` Gopi Krishna Menon
2025-10-25 13:29 ` syzbot
2025-10-25 13:34 ` Gopi Krishna Menon
` (2 subsequent siblings)
5 siblings, 1 reply; 13+ messages in thread
From: Gopi Krishna Menon @ 2025-10-25 13:20 UTC (permalink / raw)
To: syzbot
Cc: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
linux-kernel, linux-mm, matthew.brost, rakie.kim, syzkaller-bugs,
ying.huang, ziy
On Fri, Oct 24, 2025 at 04:11:28PM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 72fb0170ef1f Add linux-next specific files for 20251024
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=10fd0be2580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
> dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=119eae7c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140693e2580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/be1fa3d1f761/disk-72fb0170.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/57302bf7af40/vmlinux-72fb0170.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/91c806bb2a2b/bzImage-72fb0170.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> WARNING: mm/page_alloc.c:5190 at __alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190, CPU#1: syz.0.17/6001
> Modules linked in:
> CPU: 1 UID: 0 PID: 6001 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
> RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190
> Code: 74 10 4c 89 e7 89 54 24 0c e8 64 b9 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 b1 7d 70 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24
> RSP: 0018:ffffc90003017920 EFLAGS: 00010246
> RAX: ffffc90003017900 RBX: 0000000000000013 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003017988
> RBP: ffffc90003017a18 R08: ffffc90003017987 R09: 0000000000000000
> R10: ffffc90003017960 R11: fffff52000602f31 R12: 0000000000000000
> R13: 1ffff92000602f28 R14: 0000000000040cc0 R15: dffffc0000000000
> FS: 000055558dedb500(0000) GS:ffff888125ddc000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffef4504a80 CR3: 0000000072ffa000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2418
> ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:5583
> __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5614
> __do_kmalloc_node mm/slub.c:5630 [inline]
> __kmalloc_noprof+0x4c9/0x800 mm/slub.c:5654
> kmalloc_noprof include/linux/slab.h:961 [inline]
> raw_alloc_io_data drivers/usb/gadget/legacy/raw_gadget.c:673 [inline]
> raw_ioctl_ep_read drivers/usb/gadget/legacy/raw_gadget.c:1162 [inline]
> raw_ioctl+0x18fb/0x3be0 drivers/usb/gadget/legacy/raw_gadget.c:1325
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:597 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fccefd8efc9
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffef4505ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007fcceffe5fa0 RCX: 00007fccefd8efc9
> RDX: 00002000000000c0 RSI: 00000000c0085508 RDI: 0000000000000004
> RBP: 00007fccefe11f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fcceffe5fa0 R14: 00007fcceffe5fa0 R15: 0000000000000003
> </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
Since the maximum packet size of the endpoint descriptor is a 16 bit
field, we can make sure that the io->length is never greater than 65535
bytes.
Resend the patch as earlier one was malformed.
#syz test
diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index b71680c58de6..00f5e697d321 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -667,6 +667,8 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,
return ERR_PTR(-EINVAL);
if (!usb_raw_io_flags_valid(io->flags))
return ERR_PTR(-EINVAL);
+ if (io->length > USB_RAW_IO_MAX_LENGTH)
+ return ERR_PTR(-EINVAL);
if (get_from_user)
data = memdup_user(ptr + sizeof(*io), io->length);
else {
diff --git a/include/uapi/linux/usb/raw_gadget.h b/include/uapi/linux/usb/raw_gadget.h
index f0224a8dc858..effe8a543c75 100644
--- a/include/uapi/linux/usb/raw_gadget.h
+++ b/include/uapi/linux/usb/raw_gadget.h
@@ -106,6 +106,9 @@ struct usb_raw_ep_io {
/* Maximum number of non-control endpoints in struct usb_raw_eps_info. */
#define USB_RAW_EPS_NUM_MAX 30
+/* Maximum length for raw endpoint IO */
+#define USB_RAW_IO_MAX_LENGTH 65535
+
/* Maximum length of UDC endpoint name in struct usb_raw_ep_info. */
#define USB_RAW_EP_NAME_MAX 16
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [mm?] WARNING in raw_ioctl
2025-10-25 13:20 ` Gopi Krishna Menon
@ 2025-10-25 13:29 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-10-25 13:29 UTC (permalink / raw)
To: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
krishnagopi487, linux-kernel, linux-mm, matthew.brost, rakie.kim,
syzkaller-bugs, ying.huang, ziy
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
failed to apply patch:
checking file drivers/usb/gadget/legacy/raw_gadget.c
checking file include/uapi/linux/usb/raw_gadget.h
patch: **** unexpected end of file in patch
Tested on:
commit: 72fb0170 Add linux-next specific files for 20251024
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
compiler:
patch: https://syzkaller.appspot.com/x/patch.diff?x=1386c258580000
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [mm?] WARNING in raw_ioctl
2025-10-24 23:11 [syzbot] [mm?] WARNING in raw_ioctl syzbot
` (2 preceding siblings ...)
2025-10-25 13:20 ` Gopi Krishna Menon
@ 2025-10-25 13:34 ` Gopi Krishna Menon
2025-10-25 13:58 ` syzbot
2025-10-25 15:52 ` Gopi Krishna Menon
2025-10-28 16:27 ` Gopi Krishna Menon
5 siblings, 1 reply; 13+ messages in thread
From: Gopi Krishna Menon @ 2025-10-25 13:34 UTC (permalink / raw)
To: syzbot
Cc: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
linux-kernel, linux-mm, matthew.brost, rakie.kim, syzkaller-bugs,
ying.huang, ziy
[-- Attachment #1: Type: text/plain, Size: 5041 bytes --]
On Fri, Oct 24, 2025 at 04:11:28PM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 72fb0170ef1f Add linux-next specific files for 20251024
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=10fd0be2580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
> dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=119eae7c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140693e2580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/be1fa3d1f761/disk-72fb0170.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/57302bf7af40/vmlinux-72fb0170.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/91c806bb2a2b/bzImage-72fb0170.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> WARNING: mm/page_alloc.c:5190 at __alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190, CPU#1: syz.0.17/6001
> Modules linked in:
> CPU: 1 UID: 0 PID: 6001 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
> RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190
> Code: 74 10 4c 89 e7 89 54 24 0c e8 64 b9 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 b1 7d 70 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24
> RSP: 0018:ffffc90003017920 EFLAGS: 00010246
> RAX: ffffc90003017900 RBX: 0000000000000013 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003017988
> RBP: ffffc90003017a18 R08: ffffc90003017987 R09: 0000000000000000
> R10: ffffc90003017960 R11: fffff52000602f31 R12: 0000000000000000
> R13: 1ffff92000602f28 R14: 0000000000040cc0 R15: dffffc0000000000
> FS: 000055558dedb500(0000) GS:ffff888125ddc000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffef4504a80 CR3: 0000000072ffa000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2418
> ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:5583
> __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5614
> __do_kmalloc_node mm/slub.c:5630 [inline]
> __kmalloc_noprof+0x4c9/0x800 mm/slub.c:5654
> kmalloc_noprof include/linux/slab.h:961 [inline]
> raw_alloc_io_data drivers/usb/gadget/legacy/raw_gadget.c:673 [inline]
> raw_ioctl_ep_read drivers/usb/gadget/legacy/raw_gadget.c:1162 [inline]
> raw_ioctl+0x18fb/0x3be0 drivers/usb/gadget/legacy/raw_gadget.c:1325
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:597 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fccefd8efc9
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffef4505ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007fcceffe5fa0 RCX: 00007fccefd8efc9
> RDX: 00002000000000c0 RSI: 00000000c0085508 RDI: 0000000000000004
> RBP: 00007fccefe11f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fcceffe5fa0 R14: 00007fcceffe5fa0 R15: 0000000000000003
> </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
Since the maximum packet size of the endpoint descriptor is a 16 bit
field, we can make sure that the io->length is never greater than 65535
bytes.
Resend the patch as attachement as earlier one got cut off by syzbot.
#syz test
[-- Attachment #2: 0001-usb-raw_gadget-validate-io-length-in-raw_alloc_io_da.patch --]
[-- Type: text/x-diff, Size: 1735 bytes --]
From 06149314c2d71c1a6481db9a0fba98d4509cde6a Mon Sep 17 00:00:00 2001
From: Gopi Krishna Menon <krishnagopi487@gmail.com>
Date: Sat, 25 Oct 2025 18:55:45 +0530
Subject: [PATCH] usb: raw_gadget: validate io length in raw_alloc_io_data()
Since the maximum packet size of the endpoint descriptor is a 16 bit
field, we can make sure that the io->length is never greater than 65535
bytes.
For testing in syzbot
Signed-off-by: Gopi Krishna Menon <krishnagopi487@gmail.com>
---
drivers/usb/gadget/legacy/raw_gadget.c | 2 ++
include/uapi/linux/usb/raw_gadget.h | 3 +++
2 files changed, 5 insertions(+)
diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index b71680c58de6..00f5e697d321 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -667,6 +667,8 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,
return ERR_PTR(-EINVAL);
if (!usb_raw_io_flags_valid(io->flags))
return ERR_PTR(-EINVAL);
+ if (io->length > USB_RAW_IO_MAX_LENGTH)
+ return ERR_PTR(-EINVAL);
if (get_from_user)
data = memdup_user(ptr + sizeof(*io), io->length);
else {
diff --git a/include/uapi/linux/usb/raw_gadget.h b/include/uapi/linux/usb/raw_gadget.h
index f0224a8dc858..effe8a543c75 100644
--- a/include/uapi/linux/usb/raw_gadget.h
+++ b/include/uapi/linux/usb/raw_gadget.h
@@ -106,6 +106,9 @@ struct usb_raw_ep_io {
/* Maximum number of non-control endpoints in struct usb_raw_eps_info. */
#define USB_RAW_EPS_NUM_MAX 30
+/* Maximum length for raw endpoint IO */
+#define USB_RAW_IO_MAX_LENGTH 65535
+
/* Maximum length of UDC endpoint name in struct usb_raw_ep_info. */
#define USB_RAW_EP_NAME_MAX 16
--
2.43.0
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [mm?] WARNING in raw_ioctl
2025-10-25 13:34 ` Gopi Krishna Menon
@ 2025-10-25 13:58 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-10-25 13:58 UTC (permalink / raw)
To: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
krishnagopi487, linux-kernel, linux-mm, matthew.brost, rakie.kim,
syzkaller-bugs, ying.huang, ziy
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
Tested-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
Tested on:
commit: 72fb0170 Add linux-next specific files for 20251024
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=133e1d42580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=10c72614580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [mm?] WARNING in raw_ioctl
2025-10-24 23:11 [syzbot] [mm?] WARNING in raw_ioctl syzbot
` (3 preceding siblings ...)
2025-10-25 13:34 ` Gopi Krishna Menon
@ 2025-10-25 15:52 ` Gopi Krishna Menon
2025-10-25 16:43 ` syzbot
2025-10-28 16:27 ` Gopi Krishna Menon
5 siblings, 1 reply; 13+ messages in thread
From: Gopi Krishna Menon @ 2025-10-25 15:52 UTC (permalink / raw)
To: syzbot
Cc: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
linux-kernel, linux-mm, matthew.brost, rakie.kim, syzkaller-bugs,
ying.huang, ziy
[-- Attachment #1: Type: text/plain, Size: 5763 bytes --]
On Fri, Oct 24, 2025 at 04:11:28PM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 72fb0170ef1f Add linux-next specific files for 20251024
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=10fd0be2580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
> dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=119eae7c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140693e2580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/be1fa3d1f761/disk-72fb0170.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/57302bf7af40/vmlinux-72fb0170.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/91c806bb2a2b/bzImage-72fb0170.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> WARNING: mm/page_alloc.c:5190 at __alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190, CPU#1: syz.0.17/6001
> Modules linked in:
> CPU: 1 UID: 0 PID: 6001 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
> RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190
> Code: 74 10 4c 89 e7 89 54 24 0c e8 64 b9 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 b1 7d 70 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24
> RSP: 0018:ffffc90003017920 EFLAGS: 00010246
> RAX: ffffc90003017900 RBX: 0000000000000013 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003017988
> RBP: ffffc90003017a18 R08: ffffc90003017987 R09: 0000000000000000
> R10: ffffc90003017960 R11: fffff52000602f31 R12: 0000000000000000
> R13: 1ffff92000602f28 R14: 0000000000040cc0 R15: dffffc0000000000
> FS: 000055558dedb500(0000) GS:ffff888125ddc000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffef4504a80 CR3: 0000000072ffa000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2418
> ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:5583
> __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5614
> __do_kmalloc_node mm/slub.c:5630 [inline]
> __kmalloc_noprof+0x4c9/0x800 mm/slub.c:5654
> kmalloc_noprof include/linux/slab.h:961 [inline]
> raw_alloc_io_data drivers/usb/gadget/legacy/raw_gadget.c:673 [inline]
> raw_ioctl_ep_read drivers/usb/gadget/legacy/raw_gadget.c:1162 [inline]
> raw_ioctl+0x18fb/0x3be0 drivers/usb/gadget/legacy/raw_gadget.c:1325
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:597 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fccefd8efc9
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffef4505ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007fcceffe5fa0 RCX: 00007fccefd8efc9
> RDX: 00002000000000c0 RSI: 00000000c0085508 RDI: 0000000000000004
> RBP: 00007fccefe11f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fcceffe5fa0 R14: 00007fcceffe5fa0 R15: 0000000000000003
> </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
I misunderstood what io->data is and thought of it as a buffer for
storing one packet which dosent make any sense. Since io->data is the
raw data for the transfer itself in memory, it is possible that the
transfer length is several kilo bytes in size. This is also
documented by Andrey Konovalov in his patch [1], which dropped the
transfer length checks because there can be problems with USB devices
whose configuration descriptor exceeds PAGE_SIZE in length.
But since this value comes from userspace, it is possible that the user
passes a very large value (as in syzbot's case) which would be invalid
and raise warnings in the allocator. Therefore I think we should
validate the length in raw_alloc_io_data and prevent invalid values
(values which is greater than KMALLOC_MAX_SIZE) to prevent warnings from
the allocator.
[1] : https://lore.kernel.org/all/a6024e8eab679043e9b8a5defdb41c4bda62f02b.1761085528.git.andreyknvl@gmail.com/
#syz test
[-- Attachment #2: 0001-usb-raw_gadget-validate-io-length-in-raw_alloc_io_da.patch --]
[-- Type: text/x-diff, Size: 1198 bytes --]
From ec93e88de10f0c0b02645e9caedad75323cf767c Mon Sep 17 00:00:00 2001
From: Gopi Krishna Menon <krishnagopi487@gmail.com>
Date: Sat, 25 Oct 2025 20:48:56 +0530
Subject: [PATCH] usb: raw_gadget: validate io length in raw_alloc_io_data()
Not checking the io buffer length can allow very large allocations
which cannot be handled by the allocators and can result in warning by
the allocators. Therefore for sizes larger than KMALLOC_MAX_SIZE we
return -EINVAL.
For testing
Signed-off-by: Gopi Krishna Menon <krishnagopi487@gmail.com>
---
drivers/usb/gadget/legacy/raw_gadget.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index b71680c58de6..c922ab42b0ca 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -667,6 +667,8 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,
return ERR_PTR(-EINVAL);
if (!usb_raw_io_flags_valid(io->flags))
return ERR_PTR(-EINVAL);
+ if (io->length > KMALLOC_MAX_SIZE)
+ return ERR_PTR(-EINVAL);
if (get_from_user)
data = memdup_user(ptr + sizeof(*io), io->length);
else {
--
2.43.0
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [mm?] WARNING in raw_ioctl
2025-10-25 15:52 ` Gopi Krishna Menon
@ 2025-10-25 16:43 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-10-25 16:43 UTC (permalink / raw)
To: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
krishnagopi487, linux-kernel, linux-mm, matthew.brost, rakie.kim,
syzkaller-bugs, ying.huang, ziy
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
Tested-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
Tested on:
commit: 72fb0170 Add linux-next specific files for 20251024
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=17d91d42580000
kernel config: https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=10214be2580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [mm?] WARNING in raw_ioctl
2025-10-24 23:11 [syzbot] [mm?] WARNING in raw_ioctl syzbot
` (4 preceding siblings ...)
2025-10-25 15:52 ` Gopi Krishna Menon
@ 2025-10-28 16:27 ` Gopi Krishna Menon
2025-10-28 16:56 ` syzbot
5 siblings, 1 reply; 13+ messages in thread
From: Gopi Krishna Menon @ 2025-10-28 16:27 UTC (permalink / raw)
To: syzbot
Cc: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
linux-kernel, linux-mm, matthew.brost, rakie.kim, syzkaller-bugs,
ying.huang, ziy
[-- Attachment #1: Type: text/plain, Size: 4820 bytes --]
On Fri, Oct 24, 2025 at 04:11:28PM -0700, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 72fb0170ef1f Add linux-next specific files for 20251024
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=10fd0be2580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=e812d103f45aa955
> dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
> compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=119eae7c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=140693e2580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/be1fa3d1f761/disk-72fb0170.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/57302bf7af40/vmlinux-72fb0170.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/91c806bb2a2b/bzImage-72fb0170.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
>
> ------------[ cut here ]------------
> WARNING: mm/page_alloc.c:5190 at __alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190, CPU#1: syz.0.17/6001
> Modules linked in:
> CPU: 1 UID: 0 PID: 6001 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
> RIP: 0010:__alloc_frozen_pages_noprof+0x2c8/0x370 mm/page_alloc.c:5190
> Code: 74 10 4c 89 e7 89 54 24 0c e8 64 b9 0d 00 8b 54 24 0c 49 83 3c 24 00 0f 85 a5 fe ff ff e9 a6 fe ff ff c6 05 b1 7d 70 0d 01 90 <0f> 0b 90 e9 18 ff ff ff a9 00 00 08 00 48 8b 4c 24 10 4c 8d 44 24
> RSP: 0018:ffffc90003017920 EFLAGS: 00010246
> RAX: ffffc90003017900 RBX: 0000000000000013 RCX: 0000000000000000
> RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffc90003017988
> RBP: ffffc90003017a18 R08: ffffc90003017987 R09: 0000000000000000
> R10: ffffc90003017960 R11: fffff52000602f31 R12: 0000000000000000
> R13: 1ffff92000602f28 R14: 0000000000040cc0 R15: dffffc0000000000
> FS: 000055558dedb500(0000) GS:ffff888125ddc000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007ffef4504a80 CR3: 0000000072ffa000 CR4: 00000000003526f0
> Call Trace:
> <TASK>
> alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2418
> ___kmalloc_large_node+0x5f/0x1b0 mm/slub.c:5583
> __kmalloc_large_node_noprof+0x18/0x90 mm/slub.c:5614
> __do_kmalloc_node mm/slub.c:5630 [inline]
> __kmalloc_noprof+0x4c9/0x800 mm/slub.c:5654
> kmalloc_noprof include/linux/slab.h:961 [inline]
> raw_alloc_io_data drivers/usb/gadget/legacy/raw_gadget.c:673 [inline]
> raw_ioctl_ep_read drivers/usb/gadget/legacy/raw_gadget.c:1162 [inline]
> raw_ioctl+0x18fb/0x3be0 drivers/usb/gadget/legacy/raw_gadget.c:1325
> vfs_ioctl fs/ioctl.c:51 [inline]
> __do_sys_ioctl fs/ioctl.c:597 [inline]
> __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
> RIP: 0033:0x7fccefd8efc9
> Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
> RSP: 002b:00007ffef4505ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
> RAX: ffffffffffffffda RBX: 00007fcceffe5fa0 RCX: 00007fccefd8efc9
> RDX: 00002000000000c0 RSI: 00000000c0085508 RDI: 0000000000000004
> RBP: 00007fccefe11f91 R08: 0000000000000000 R09: 0000000000000000
> R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
> R13: 00007fcceffe5fa0 R14: 00007fcceffe5fa0 R15: 0000000000000003
> </TASK>
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want syzbot to run the reproducer, reply with:
> #syz test: git://repo/address.git branch-or-commit-hash
> If you attach or paste a git patch, syzbot will apply it before testing.
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
#syz test
[-- Attachment #2: 0001-usb-raw-gadget-cap-raw_io-transfer-length-to-KMALLOC.patch --]
[-- Type: text/x-diff, Size: 2628 bytes --]
From a483c5673cef7995e74dc3556196e25344b5e434 Mon Sep 17 00:00:00 2001
From: Gopi Krishna Menon <krishnagopi487@gmail.com>
Date: Tue, 28 Oct 2025 20:18:04 +0530
Subject: [PATCH] usb: raw-gadget: cap raw_io transfer length to
KMALLOC_MAX_SIZE
To: andreyknvl@gmail.com,
gregkh@linuxfoundation.org
Cc: snovitoll@gmail.com,
linux-usb@vger.kernel.org,
linux-kernel@vger.kernel.org,
skhan@linuxfoundation.org,
david.hunter.linux@gmail.com,
khalid@kernel.org,
linux-kernel-mentees@lists.linux.dev,
syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
The previous commit removed the PAGE_SIZE limit on transfer length of
raw_io buffer in order to avoid any problems with emulating USB devices
whose full configuration descriptor exceeds PAGE_SIZE in length. However
this also removes the upperbound on user supplied length, allowing very
large values to be passed to the allocator.
syzbot on fuzzing the transfer length with very large value (1.81GB)
results in kmalloc() to fall back to the page allocator, which triggers
a kernel warning as the page allocator cannot handle allocations more
than MAX_PAGE_ORDER/KMALLOC_MAX_SIZE.
Since there is no limit imposed on the size of buffer for both control
and non control transfers, cap the raw_io transfer length to
KMALLOC_MAX_SIZE and return -EINVAL for larger transfer length to
prevent any warnings from the page allocator.
Fixes: 37b9dd0d114a ("usb: raw-gadget: do not limit transfer length")
Tested-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/68fc07a0.a70a0220.3bf6c6.01ab.GAE@google.com/
Signed-off-by: Gopi Krishna Menon <krishnagopi487@gmail.com>
---
drivers/usb/gadget/legacy/raw_gadget.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/gadget/legacy/raw_gadget.c b/drivers/usb/gadget/legacy/raw_gadget.c
index b71680c58de6..46f343ba48b3 100644
--- a/drivers/usb/gadget/legacy/raw_gadget.c
+++ b/drivers/usb/gadget/legacy/raw_gadget.c
@@ -40,6 +40,7 @@ MODULE_LICENSE("GPL");
static DEFINE_IDA(driver_id_numbers);
#define DRIVER_DRIVER_NAME_LENGTH_MAX 32
+#define USB_RAW_IO_LENGTH_MAX KMALLOC_MAX_SIZE
#define RAW_EVENT_QUEUE_SIZE 16
@@ -667,6 +668,8 @@ static void *raw_alloc_io_data(struct usb_raw_ep_io *io, void __user *ptr,
return ERR_PTR(-EINVAL);
if (!usb_raw_io_flags_valid(io->flags))
return ERR_PTR(-EINVAL);
+ if (io->length > USB_RAW_IO_LENGTH_MAX)
+ return ERR_PTR(-EINVAL);
if (get_from_user)
data = memdup_user(ptr + sizeof(*io), io->length);
else {
--
2.43.0
^ permalink raw reply [flat|nested] 13+ messages in thread
* Re: [syzbot] [mm?] WARNING in raw_ioctl
2025-10-28 16:27 ` Gopi Krishna Menon
@ 2025-10-28 16:56 ` syzbot
0 siblings, 0 replies; 13+ messages in thread
From: syzbot @ 2025-10-28 16:56 UTC (permalink / raw)
To: akpm, apopple, byungchul, david, gourry, joshua.hahnjy,
krishnagopi487, linux-kernel, linux-mm, matthew.brost, rakie.kim,
syzkaller-bugs, ying.huang, ziy
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
Tested-by: syzbot+d8fd35fa6177afa8c92b@syzkaller.appspotmail.com
Tested on:
commit: f7d2388e Add linux-next specific files for 20251028
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=1244432f980000
kernel config: https://syzkaller.appspot.com/x/.config?x=d0af39d067deaba8
dashboard link: https://syzkaller.appspot.com/bug?extid=d8fd35fa6177afa8c92b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=14461f34580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 13+ messages in thread
end of thread, other threads:[~2025-10-28 16:56 UTC | newest]
Thread overview: 13+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-10-24 23:11 [syzbot] [mm?] WARNING in raw_ioctl syzbot
2025-10-25 9:16 ` Gopi Krishna Menon
2025-10-25 10:25 ` syzbot
2025-10-25 13:02 ` Gopi Krishna Menon
2025-10-25 13:15 ` syzbot
2025-10-25 13:20 ` Gopi Krishna Menon
2025-10-25 13:29 ` syzbot
2025-10-25 13:34 ` Gopi Krishna Menon
2025-10-25 13:58 ` syzbot
2025-10-25 15:52 ` Gopi Krishna Menon
2025-10-25 16:43 ` syzbot
2025-10-28 16:27 ` Gopi Krishna Menon
2025-10-28 16:56 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox