On Mon, 12 Dec 2016, Michal Hocko wrote: > On Mon 12-12-16 21:32:35, Andrey Konovalov wrote: > > On Mon, Dec 12, 2016 at 9:31 PM, Andrey Konovalov <andreyknvl@xxxxxxxxxx> wrote: > > > Hi! > > > > > > While running the syzkaller fuzzer I've got the following error report. > > > > > > The issue is that the len argument is not checked for being too big. > > Well, the value is checked in kmalloc_slab. There is a discrepancy > though. While the page allocator enforces order < MAX_ORDER, slab > allocators enforce size <= KMALLOC_MAX_SIZE and > > KMALLOC_MAX_SIZE is 1UL << (MAX_ORDER + PAGE_SHIFT) for SLUB which is > what I expect you have or 1UL << (MAX_ORDER + PAGE_SHIFT - 1) for SLAB > on most archs. This means that KMALLOC_MAX_SIZE might be MAX_ORDER for > SLUB which would explain your warning. > > Let's CC Christoph, this is nothing really new, but I suspect that SLUB > should change the maximum size to something like SLAB does. > > That being said, what ep_write_iter does sounds quite stupit. It just > allocates a large continuous buffer which seems to be under user > control... Aka no good! It should do that per pages or something like > that. Something worth fixing It's not important enough to make the driver do all this work. If users want to send large amounts of data, they can send it a page at a time (or something like that). If you really want to prevent the driver from attempting to allocate a large buffer, all that's needed is an upper limit on the total size. For example, 64 KB. Alan Stern -- To unsubscribe from this list: send the line "unsubscribe linux-usb" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
