On Mon, May 15, 2023 at 09:09:55PM +0800, Ruihan Li wrote: > The current implementation of usbdev_mmap uses usb_alloc_coherent to > allocate memory pages that will later be mapped into the user space. > Meanwhile, usb_alloc_coherent employs three different methods to > allocate memory, as outlined below: > * If hcd->localmem_pool is non-null, it uses gen_pool_dma_alloc to > allocate memory; > * If DMA is not available, it uses kmalloc to allocate memory; > * Otherwise, it uses dma_alloc_coherent. > > However, it should be noted that gen_pool_dma_alloc does not guarantee > that the resulting memory will be page-aligned. Furthermore, trying to > map slab pages (i.e., memory allocated by kmalloc) into the user space > is not resonable and can lead to problems, such as a type confusion bug > when PAGE_TABLE_CHECK=y [1]. > > To address these issues, this patch introduces hcd_alloc_coherent_pages, > which addresses the above two problems. Specifically, > hcd_alloc_coherent_pages uses gen_pool_dma_alloc_align instead of > gen_pool_dma_alloc to ensure that the memory is page-aligned. To replace > kmalloc, hcd_alloc_coherent_pages directly allocates pages by calling > __get_free_pages. > > Reported-by: syzbot+fcf1a817ceb50935ce99@xxxxxxxxxxxxxxxxxxxxxxxxxx > Closes: https://lore.kernel.org/lkml/000000000000258e5e05fae79fc1@xxxxxxxxxx/ [1] > Fixes: f7d34b445abc ("USB: Add support for usbfs zerocopy.") > Fixes: ff2437befd8f ("usb: host: Fix excessive alignment restriction for local memory allocations") > Cc: stable@xxxxxxxxxxxxxxx > Signed-off-by: Ruihan Li <lrh2000@xxxxxxxxxx> > --- For parts 1/4 and 2/4: Acked-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx> Alan Stern
