From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B3BAC77B75 for ; Mon, 15 May 2023 14:08:49 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id BE7CC900004; Mon, 15 May 2023 10:08:48 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id B70FC900002; Mon, 15 May 2023 10:08:48 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id A1366900004; Mon, 15 May 2023 10:08:48 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) by kanga.kvack.org (Postfix) with ESMTP id 91D31900002 for ; Mon, 15 May 2023 10:08:48 -0400 (EDT) Received: from smtpin29.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay06.hostedemail.com (Postfix) with ESMTP id 5F8FBAF3C7 for ; Mon, 15 May 2023 14:08:48 +0000 (UTC) X-FDA: 80792670336.29.90D2EED Received: from netrider.rowland.org (netrider.rowland.org [192.131.102.5]) by imf12.hostedemail.com (Postfix) with SMTP id 1A59B4008E for ; Mon, 15 May 2023 14:07:16 +0000 (UTC) Authentication-Results: imf12.hostedemail.com; dkim=none; spf=pass (imf12.hostedemail.com: domain of stern+64678ccc@netrider.rowland.org designates 192.131.102.5 as permitted sender) smtp.mailfrom=stern+64678ccc@netrider.rowland.org; dmarc=none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1684159637; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=jA3QwQjBqDJrJTjgRNETRueuYrj+CbZcHOaOvd2mTCk=; b=iFEB4TraPXujbbsBD+wG1ydT9NVNM07FLPHLubyNLdMyPhigMx5tozvUC703GzOa+cSK3T NcN4fEiVuqXvZXlgYihKbAtH0JyXnLHPcj1CU4zcOOcDKqjXSXw2fumbcrx85+3RczvsTS 6HNUmFxDZHGO2rtm9x1Ln80rtcBsnwc= ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1684159637; a=rsa-sha256; cv=none; b=ANFhurQXTwI196OerKRfatXMnv11hU5ldrwp9J5ufYNRXqcnHUWp/silkESoy3QxppDeB1 ySlwAQALc2ngqB9cSAtAW4hwEjQ1hESIJ8jm9bY/ZvQIXSoTTrJMkBycCvvjRsoONHn7bp PWcnHl8Es8ZcEGaUZOYQNxkB/xfGZYU= ARC-Authentication-Results: i=1; imf12.hostedemail.com; dkim=none; spf=pass (imf12.hostedemail.com: domain of stern+64678ccc@netrider.rowland.org designates 192.131.102.5 as permitted sender) smtp.mailfrom=stern+64678ccc@netrider.rowland.org; dmarc=none Received: (qmail 791507 invoked by uid 1000); 15 May 2023 10:07:15 -0400 Date: Mon, 15 May 2023 10:07:15 -0400 From: Alan Stern To: Ruihan Li Cc: linux-mm@kvack.org, linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org, Pasha Tatashin , David Hildenbrand , Matthew Wilcox , Andrew Morton , Christoph Hellwig , Greg Kroah-Hartman , syzbot+fcf1a817ceb50935ce99@syzkaller.appspotmail.comm, stable@vger.kernel.org Subject: Re: [PATCH v2 1/4] usb: usbfs: Enforce page requirements for mmap Message-ID: <761a2bf5-fdd3-4b4d-a14c-87add51db13a@rowland.harvard.edu> References: <20230515130958.32471-1-lrh2000@pku.edu.cn> <20230515130958.32471-2-lrh2000@pku.edu.cn> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230515130958.32471-2-lrh2000@pku.edu.cn> X-Stat-Signature: 78js5numjdj9npxqszcib5jpexyw8hx7 X-Rspamd-Server: rspam03 X-Rspam-User: X-Rspamd-Queue-Id: 1A59B4008E X-HE-Tag: 1684159636-3077 X-HE-Meta: U2FsdGVkX1/rElpRXL58QiycO97Is+EuAdxZo5VQxiO2n4Z4eyVg1rnU5eZG49EoLwQNFL77XmXZF+h4x755qO/y+XoL/RvDi4DPMLoYg9U6WbpP70logSU/+i3A8fZ7b80UxM8zZyWKfhArGBxqW91BLGrlL0rQ26hSwG5hmCIzrS3+k0VjnMyIIQLYzwM+RkLxo2BgKhnqQfu30Mg23WE0EpK64GKF3rAq1HaHsNcjTKeIrZl+X5VL2By5MgIdjhcqgIlLTigNR5Jxy5TCyhWtBiKXoVKOvr3u340hJIGOoacOKi5lpkxNjrQwusNrYaGnHAXGR5MXgmKmm938IFImc6MvPHynhewqVd+n4rt+hF1E7TXWbyNUj9maRHHqvfIGONN0bu/zug97oSH1VtrkaJCjQ/nB/M0t5PUoJMZ0C3klSlE9plEdYTP1K5FStars1SgAOZ46XsLnzIlQKF6JsuCc6FixokPnF2Cf/2WEzhi2Nou4s0zG3uCccNxz6v9kHBs3y8ak6YiNkHMxNhwITZZSH7UTskgl7EFce10Nji2ffRuYc7g1rrAPKSQIht883QPPEAdPACnGaH9GQQrPARPPLUNiTYZOTYrHjRdcciw/DYrMKsXhbJo8KHDe9HvKVW+/fk3aH9WfPiXIEqsyneyK2HFtfj5o1K62aEudee7cXUeO3uhg/MssSCLlomrrU6+mojcKSMQ3uBIJlBHDApIhjB0LVqo+yN7zUyv6vCLoRfRdrdq/3CxvpqytYgmEjRB3MYBro9jwvIMgSBdUxLsDNiIxaiLoWa0ZlqLEeTReCdF0embetUGIo87/RnzwYoh0j4FQ8jnG8ns9KbiXq2mLNUpbjUHFP9z9oesnLGBFsYBZqx6eTDCNLsD2yWcetiDaZgigu93tDwdMUJEEHvvw7TG79ZLJZI88263roDx5AYF6v1RgSnQTAGUz2J6HQ5pNoFL77WH35uX TnMta8dt tfOkeuiiwHT9TSiLD+PlRiuR4VInowXHxhv1sJZRtqrhhx4D0LQ3Tvkdkgg6EDP78XDkBx5zmr43FE8VtiwUTGm7AVLkjWhNuk53PtGDDFIj71+4jJkT+/p0xp2rWNCE7IOqRIGv35w+sRbVdlZ59w9kwpiA3t/qAt7ZBnxV3pa8YK5ca6KrTSIqL7OW0QhcPpVO0TvtmbO8zDw/QBeKgxM4ADTTaefpcqhsF9Fr5GZqJ7b76/vciGj4hCu4nl/YFBKHDm/ilUuC1uGq5YcuLXvwVsqv/61srhYi5UQXj9PQoXF15CKt16p/SnJcbxv+WVmLW+Llk10uzYO7CoqxIhygEPIjT7mMcDp+BMKohtaWSC32B2ks2RCQi/GMig1gnQueuef5f9IygUTfrkFQVQa9hVg== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Mon, May 15, 2023 at 09:09:55PM +0800, Ruihan Li wrote: > The current implementation of usbdev_mmap uses usb_alloc_coherent to > allocate memory pages that will later be mapped into the user space. > Meanwhile, usb_alloc_coherent employs three different methods to > allocate memory, as outlined below: > * If hcd->localmem_pool is non-null, it uses gen_pool_dma_alloc to > allocate memory; > * If DMA is not available, it uses kmalloc to allocate memory; > * Otherwise, it uses dma_alloc_coherent. > > However, it should be noted that gen_pool_dma_alloc does not guarantee > that the resulting memory will be page-aligned. Furthermore, trying to > map slab pages (i.e., memory allocated by kmalloc) into the user space > is not resonable and can lead to problems, such as a type confusion bug > when PAGE_TABLE_CHECK=y [1]. > > To address these issues, this patch introduces hcd_alloc_coherent_pages, > which addresses the above two problems. Specifically, > hcd_alloc_coherent_pages uses gen_pool_dma_alloc_align instead of > gen_pool_dma_alloc to ensure that the memory is page-aligned. To replace > kmalloc, hcd_alloc_coherent_pages directly allocates pages by calling > __get_free_pages. > > Reported-by: syzbot+fcf1a817ceb50935ce99@syzkaller.appspotmail.comm > Closes: https://lore.kernel.org/lkml/000000000000258e5e05fae79fc1@google.com/ [1] > Fixes: f7d34b445abc ("USB: Add support for usbfs zerocopy.") > Fixes: ff2437befd8f ("usb: host: Fix excessive alignment restriction for local memory allocations") > Cc: stable@vger.kernel.org > Signed-off-by: Ruihan Li > --- For parts 1/4 and 2/4: Acked-by: Alan Stern Alan Stern