From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD968C77B75 for ; Tue, 9 May 2023 13:25:57 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DF34B280014; Tue, 9 May 2023 09:25:56 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id DA35A280012; Tue, 9 May 2023 09:25:56 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C9223280014; Tue, 9 May 2023 09:25:56 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0015.hostedemail.com [216.40.44.15]) by kanga.kvack.org (Postfix) with ESMTP id B6FFD280012 for ; Tue, 9 May 2023 09:25:56 -0400 (EDT) Received: from smtpin28.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 7DC3E160261 for ; Tue, 9 May 2023 13:25:56 +0000 (UTC) X-FDA: 80770789512.28.52EA048 Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) by imf04.hostedemail.com (Postfix) with ESMTP id D8C4B40012 for ; Tue, 9 May 2023 13:25:52 +0000 (UTC) Authentication-Results: imf04.hostedemail.com; dkim=pass header.d=infradead.org header.s=bombadil.20210309 header.b=FBbYsSJD; dmarc=none; spf=none (imf04.hostedemail.com: domain of BATV+bc48d17090a6f36d612e+7198+infradead.org+hch@bombadil.srs.infradead.org has no SPF policy when checking 198.137.202.133) smtp.mailfrom=BATV+bc48d17090a6f36d612e+7198+infradead.org+hch@bombadil.srs.infradead.org ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1683638753; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=KkqdRlUqTfle/lYv4ZxNsnZATjCjThA8plTsZKPzERM=; b=NKNlS9Gq1HVdPOLau+mPWruX91dSxuVrE7TVjMTZEyxDQ3VQtUs67oHRRZbaE+suKUF+zj yQAS1id6gaHgFY+ySLW7CqiouD/RgGfn4YGkrZMSHwIATAgJ+YY9aVV6S+5tIuhsP8vTtx eOB5AelahE6uOkeq/0EIx8Bat7JTWp8= ARC-Authentication-Results: i=1; imf04.hostedemail.com; dkim=pass header.d=infradead.org header.s=bombadil.20210309 header.b=FBbYsSJD; dmarc=none; spf=none (imf04.hostedemail.com: domain of BATV+bc48d17090a6f36d612e+7198+infradead.org+hch@bombadil.srs.infradead.org has no SPF policy when checking 198.137.202.133) smtp.mailfrom=BATV+bc48d17090a6f36d612e+7198+infradead.org+hch@bombadil.srs.infradead.org ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1683638753; a=rsa-sha256; cv=none; b=NLoMn9ABp/iRQxLZgmENZwN8F6U9ap7fJTBFlM3QX8ab6f9fj023/fPhJn0P9kaD++cwb3 OyRCddlRxRVxJwbf5W7+je5OPsyVB01+Bj6gnUsH6xspV/y4nfZ5HvW1Ng5rNCGVRnoVOi RgoERSR7Dextc4Fs5HqBufUCWsEKFaE= DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=bombadil.20210309; h=In-Reply-To:Content-Type:MIME-Version :References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=KkqdRlUqTfle/lYv4ZxNsnZATjCjThA8plTsZKPzERM=; b=FBbYsSJDiapHHKmOXLJjPcHlfA 2b7UFlLrJM2/KG1rwYBEUmutob3kdAzgoMniGXUUy1YL64qvbxmGBESnIi6KWBlf2AarPUfZJbMXe RHh/+6ovolYDesxApYaOOV69N4ZFqBugnidcCDrLCUp4zraIg/KphUf/AGLkmvco8LE0baHsiiIH5 YCWKT7p4+J2kU+UA3Fe8u2WdLmCf2WdpkAzvBZrC0Iavymmc2vFlwT0aPizuD015Wxh06Yp8Gt485 v1SifxO1pisxS8h2ksTNDhhQ4kt5S3ELar5M+ZwlwMPwExrn/2TwGxgF3I+IrQt1a+2O0zf6Lf7FH QXMfVEXg==; Received: from hch by bombadil.infradead.org with local (Exim 4.96 #2 (Red Hat Linux)) id 1pwNLa-003Ota-1B; Tue, 09 May 2023 13:25:42 +0000 Date: Tue, 9 May 2023 06:25:42 -0700 From: Christoph Hellwig To: Ruihan Li Cc: syzbot+fcf1a817ceb50935ce99@syzkaller.appspotmail.com, akpm@linux-foundation.org, linux-kernel@vger.kernel.org, linux-mm@kvack.org, pasha.tatashin@soleen.com, gregkh@linuxfoundation.org, linux-usb@vger.kernel.org, syzkaller-bugs@googlegroups.com Subject: Re: usbdev_mmap causes type confusion in page_table_check Message-ID: References: <000000000000258e5e05fae79fc1@google.com> <20230507135844.1231056-1-lrh2000@pku.edu.cn> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20230507135844.1231056-1-lrh2000@pku.edu.cn> X-SRS-Rewrite: SMTP reverse-path rewritten from by bombadil.infradead.org. See http://www.infradead.org/rpr.html X-Stat-Signature: ou19an5zhmmkt43xda9tpew4snuh7e1s X-Rspam-User: X-Rspamd-Queue-Id: D8C4B40012 X-Rspamd-Server: rspam07 X-HE-Tag: 1683638752-669319 X-HE-Meta: U2FsdGVkX1/rxcNLyUh8qQmeD+WfUasfpxOx8Pah1uSuxSIWapGqGLhewlEt84A9DHzsdAgTsOCC/4e33UlDfDnwAIb6GPQTiq6RlcUIsOt1BTiNUnW0r7ypQ2p+y6qLB4KZXUlJtNJ6H7zm0Cpe6egpi+G6iR69+TxtK2RRa74XLZ17ct4SWwVZIqUr5Gca7J7BYo3sce1V7TXreD8Eu2s3BqAVogYC2O0UceVahznKOHZh0pTmdpDamJ9yjxq/Ks93hkF2VE1gnKfazfsXA6WYl490vT8T0suq2uS/x8cTfUZxxmKDN4TRSomnYMME9PCgBDWkU3gE2AzdCePzD4LKa56DUMnWTKsy5n6f4TRyv+/+dyHQPdp0WUEUqOV8wwEXrt0enWPXf/8hddkXw+/sGjEaBBAJkJEpd2QARuSB3Ve+s8C7ko2Yd6DegpRZ1qivCY0//vp7ojcKKy4VTJ4l7+3TKdCckDq/+StQCKY2RQarPK5j1THelp+rrD2eXYtWzSLln/aKBTf7UnRoNtGhQ7i9JmxBVi+dtS/XGhVr8SPQKWZIhpUFFzdIe2YgLuP8GKDLfhnMBgT2Dg4m1s+FKOeLpErQ/hkIZ043Qh3peCDE31fUaaUprwkm312LLlrIjlFyT4M3G3hOqOJw/fuUw84XGBlWCHN5lKJRn+8plj/8SQs7tT4fb1fpLNW6ueB6W++lKZUNs19JaG89cSV3Wmv8HKsngCZmF462XkeB+9z2kSaGMivIRLRtgi9SR2n8KbbzxtEgntwGh5EJ98KfWypWt6ekGWOVRgagYFAfXljjzZ2L+obsksyWsdhFdtWn2OwEoth9KygFPu06EsokPV3TuM9Yf6ofADk6XQHw/IzsMKOgZs1pBR4auhI1bSAoOfRZWqqlFtgVP9iLX6KGFqVvlN5shOdXtTIVsmtB3r15LIokOn5N134uTkkf7GohlbPdifzAZwvHZeF nVLf9IEU IqOkGxduDWrdD8tFn0Hs3lz+otcBzE3OEO8+T1JeljlwrlyUXFaf/UtSh2n1CCdWEnofculHMoXlFeskpJ3Cs4GmcajKPr6fDVkbEZQk41EjOVEWXTGfO81oSdT7jCi5BpeHJr3nwuBF/a+3QRPnIGaJreQiSbEyrfysHarSEeYEQFDCWm30V49sgE/MV1Cb2lhE7k57z9PydV7F7oBjgU+xGo7I5+eb3GmdWKYVL9H5BYtyQhZ+KztdvyPlqPY0a/dMk2c7Q0ILosQgDL02yl1HvQGcEv9EnE62t8rw9cML3IHNDJ/gxIE5YXM68oiGkX564cWsu6DQoRF47MmIx2ns4n2ses40CDFwnTjqqA68jW6thS4VnKuxQTDU5wxcQUn4L8fzggoRA3mEwAv187j4ZH9yTNTgvyaoeaIx7RMFBBhpD3zTi+Kt0VAQ+7mtANFwMAUzqnDXvTDsLO/QxWQRLCMYB27U7Ql9dqtSuEeYIFbwnFQiiYczVyBE1libd26DQx0U64rHRw6LG4SoJe6Uqog== X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Sun, May 07, 2023 at 09:58:44PM +0800, Ruihan Li wrote: > static int usbdev_mmap(struct file *file, struct vm_area_struct *vma) > { > // ... > mem = usb_alloc_coherent(ps->dev, size, GFP_USER | __GFP_NOWARN, > &dma_handle); > // ... > if (hcd->localmem_pool || !hcd_uses_dma(hcd)) { > if (remap_pfn_range(vma, vma->vm_start, > virt_to_phys(usbm->mem) >> PAGE_SHIFT, usb_alloc_coherent and up in the DMA coherent allocator (usually anyway), and you absolutely must never do a virt_to_phys or virt_to_page on that return value. This code is a buggy as f**k.