Hello, When fuzzing the Linux kernel driver v5.18.0, the following crash was triggered. HEAD commit: 4b0986a3613c92f4ec1bdc7f60ec66fea135991f (HEAD, tag: v5.18) git tree: upstream kernel config: https://pastebin.com/KecL2gaG C reproducer: https://pastebin.com/sh8uUVpV console output: https://pastebin.com/yV0hwZSi Basically, in the c reproducer, we use the gadget module to emulate the process of attaching a usb device (vendor id: 0x13d3, product id:0x3333, with function: midi). To reproduce this crash, we utilize a third-party library to emulate the attaching process: https://github.com/linux-usb-gadgets/libusbgx. Just clone this repository, make install it, and compile the c reproducer with ``` gcc crash.c -lusbgx -o crash ``` will do the trick. It seems that when calling a pre-allocate write usb requests to use on f_midi_transmit, kernel will eventually call alloc_ep_req function, and a failed kmalloc allocation on the buffer filed within use_request struct will cause this error happen. The crash report is as follow: ``` ------------[ cut here ]------------ WARNING: CPU: 1 PID: 0 at mm/page_alloc.c:5402 __alloc_pages+0x3e9/0x6e0 mm/page_alloc.c:5402 Modules linked in: CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.19.0-rc4-00208-g69cb6c6556ad #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 RIP: 0010:__alloc_pages+0x3e9/0x6e0 mm/page_alloc.c:5402 Code: 0f 84 06 02 00 00 41 be 41 00 00 00 e9 df fd ff ff 83 fe 0a 0f 86 e1 fc ff ff 80 3d 62 05 c5 07 00 75 09 c6 05 59 05 c5 07 01 <0f> 0b 45 31 f6 e9 69 ff ff ff 65 8b 2d 16 07 90 7e 83 fd 07 0f 87 RSP: 0018:ffffc90000198730 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 1ffff920000330ea RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000013 RDI: 0000000000000000 RBP: 0000000000040a20 R08: ffffffff8177d993 R09: 0000000000000005 R10: 0000000000000003 R11: fffffbfff128458a R12: 0000000000000013 R13: 0000000000000000 R14: 0000000000000000 R15: 1ffff1102201463e FS: 0000000000000000(0000) GS:ffff88811a880000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559410745860 CR3: 0000000114927000 CR4: 0000000000350ee0 Call Trace: <IRQ> alloc_pages+0x119/0x250 mm/mempolicy.c:2272 kmalloc_order+0x34/0xf0 mm/slab_common.c:945 kmalloc_order_trace+0x14/0x120 mm/slab_common.c:961 kmalloc_large include/linux/slab.h:529 [inline] __kmalloc+0x395/0x4b0 mm/slub.c:4435 kmalloc include/linux/slab.h:605 [inline] alloc_ep_req+0x146/0x1e0 drivers/usb/gadget/u_f.c:22 midi_alloc_ep_req drivers/usb/gadget/function/f_midi.c:230 [inline] f_midi_set_alt drivers/usb/gadget/function/f_midi.c:384 [inline] f_midi_set_alt+0x22f/0x630 drivers/usb/gadget/function/f_midi.c:363 set_config drivers/usb/gadget/composite.c:933 [inline] composite_setup+0x3b5c/0x76a0 drivers/usb/gadget/composite.c:1829 configfs_composite_setup+0x101/0x140 drivers/usb/gadget/configfs.c:1467 dummy_timer+0x1699/0x33f0 drivers/usb/gadget/udc/dummy_hcd.c:1920 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers kernel/time/timer.c:1790 [inline] __run_timers kernel/time/timer.c:1763 [inline] run_timer_softirq+0x1084/0x16d0 kernel/time/timer.c:1803 __do_softirq+0x1c0/0x8ee kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu kernel/softirq.c:650 [inline] irq_exit_rcu+0xe2/0x120 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x8e/0xc0 arch/x86/kernel/apic/apic.c:1106 </IRQ> <TASK> asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649 RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:731 Code: 75 fe ff 4c 89 e2 48 89 ef 5d 41 5c 31 f6 e9 7c f8 5e fc cc cc cc cc cc cc cc cc cc cc cc cc eb 07 0f 00 2d 77 9a 4d 00 fb f4 <c3> 0f 1f 40 00 41 54 be 08 00 00 00 53 65 48 8b 1c 25 c0 6e 02 00 RSP: 0018:ffffc9000010fde8 EFLAGS: 00000202 RAX: 00000000001580e9 RBX: 0000000000000001 RCX: ffffffff85f2eeb0 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000 RBP: 0000000000000001 R08: 0000000000000001 R09: ffffed1023517153 R10: ffff88811a8b8a93 R11: ffffed1023517152 R12: 0000000000000001 R13: 0000000000000001 R14: ffffffff89422c50 R15: 0000000000000000 default_idle_call+0xbd/0x420 kernel/sched/idle.c:109 cpuidle_idle_call kernel/sched/idle.c:191 [inline] do_idle+0x3f9/0x570 kernel/sched/idle.c:303 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400 start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:266 secondary_startup_64_no_verify+0xce/0xdb </TASK> ---------------- Code disassembly (best guess): 0: 75 fe jne 0x0 2: ff 4c 89 e2 decl -0x1e(%rcx,%rcx,4) 6: 48 89 ef mov %rbp,%rdi 9: 5d pop %rbp a: 41 5c pop %r12 c: 31 f6 xor %esi,%esi e: e9 7c f8 5e fc jmpq 0xfc5ef88f 13: cc int3 14: cc int3 15: cc int3 16: cc int3 17: cc int3 18: cc int3 19: cc int3 1a: cc int3 1b: cc int3 1c: cc int3 1d: cc int3 1e: cc int3 1f: eb 07 jmp 0x28 21: 0f 00 2d 77 9a 4d 00 verw 0x4d9a77(%rip) # 0x4d9a9f 28: fb sti 29: f4 hlt * 2a: c3 retq <-- trapping instruction 2b: 0f 1f 40 00 nopl 0x0(%rax) 2f: 41 54 push %r12 31: be 08 00 00 00 mov $0x8,%esi 36: 53 push %rbx 37: 65 48 8b 1c 25 c0 6e mov %gs:0x26ec0,%rbx 3e: 02 00 ```
