Re: usb: memory allocation WARNING in hcd_buffer_alloc

From: Alan Stern
Date: Tue Jul 05 2016 - 11:42:13 EST


On Tue, 5 Jul 2016, Dmitry Vyukov wrote:

> Hello,
>
> The following program trigger the following WARNING:
>
> ------------[ cut here ]------------
> WARNING: CPU: 0 PID: 6263 at mm/page_alloc.c:3584[< inline >]
> __alloc_pages_slowpath mm/page_alloc.c:3584
> WARNING: CPU: 0 PID: 6263 at mm/page_alloc.c:3584[< none >]
> __alloc_pages_nodemask+0x1731/0x2350 mm/page_alloc.c:3854
> Modules linked in:
> CPU: 0 PID: 6263 Comm: a.out Not tainted 4.7.0-rc5+ #28
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
> ffffffff880b58e0 ffff88006ad3f778 ffffffff82cc01af ffffffff86cf92c0
> fffffbfff1016b1c 0000000000000000 0000000000000000 ffffffff86cf92c0
> ffffffff816b7881 0000000000000009 ffff88006ad3f7c0 ffffffff8136d17f
> Call Trace:
> [< inline >] __dump_stack lib/dump_stack.c:15
> [<ffffffff82cc01af>] dump_stack+0x12e/0x18f lib/dump_stack.c:51
> [<ffffffff8136d17f>] __warn+0x19f/0x1e0 kernel/panic.c:516
> [<ffffffff8136d38c>] warn_slowpath_null+0x2c/0x40 kernel/panic.c:551
> [< inline >] __alloc_pages_slowpath mm/page_alloc.c:3584
> [<ffffffff816b7881>] __alloc_pages_nodemask+0x1731/0x2350 mm/page_alloc.c:3854
> [< inline >] __alloc_pages include/linux/gfp.h:432
> [< inline >] __alloc_pages_node include/linux/gfp.h:445
> [< inline >] alloc_pages_node include/linux/gfp.h:459
> [<ffffffff8120b28f>] dma_generic_alloc_coherent+0xff/0x250
> arch/x86/kernel/pci-dma.c:102
> [< inline >] dma_alloc_attrs include/linux/dma-mapping.h:374
> [< inline >] dma_alloc_coherent include/linux/dma-mapping.h:401
> [<ffffffff84699f1d>] hcd_buffer_alloc+0x1dd/0x400 drivers/usb/core/buffer.c:140
> [<ffffffff8465a670>] usb_alloc_coherent+0x60/0x80 drivers/usb/core/usb.c:740
> [<ffffffff846a12ba>] usbdev_mmap+0x19a/0x650 drivers/usb/core/devio.c:244
> [<ffffffff8175ae2f>] mmap_region+0x87f/0xfe0 mm/mmap.c:1507
> [<ffffffff8175bf2d>] do_mmap+0x99d/0xbf0 mm/mmap.c:1286
> [< inline >] do_mmap_pgoff include/linux/mm.h:2005
> [<ffffffff81701e66>] vm_mmap_pgoff+0x156/0x1a0 mm/util.c:302
> [< inline >] SYSC_mmap_pgoff mm/mmap.c:1336
> [<ffffffff81754dea>] SyS_mmap_pgoff+0x34a/0x580 mm/mmap.c:1294
> [< inline >] SYSC_mmap arch/x86/kernel/sys_x86_64.c:95
> [<ffffffff81208ff6>] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:86
> [<ffffffff86a94e00>] entry_SYSCALL_64_fastpath+0x23/0xc1
> arch/x86/entry/entry_64.S:207
> ---[ end trace 94402e12bc6578e5 ]---
>
> // autogenerated by syzkaller (http://github.com/google/syzkaller)
> #include <pthread.h>
> #include <stdint.h>
> #include <string.h>
> #include <sys/syscall.h>
> #include <unistd.h>
> #include <sys/mman.h>
>
> int main()
> {
> int fd = open("/dev/bus/usb/001/001", 0x800ul, 0);
> mmap((void*)0x201c4000ul, 0xc00000ul, 0x3ul, 0x20012ul, fd, 0x0ul);
> return 0;
> }
>
> On commit 1a0a02d1efa066001fd315c1b4df583d939fa2c4 (Jun 30).

This is an attempt to allocate 12 MB of coherent memory. As far as I
can tell, the WARNING refers to invalid bits set in the gfp_mask.

However the original allocation comes from usbdev_mmap() in
drivers/usb/core/devio.c:

mem = usb_alloc_coherent(ps->dev, size, GFP_USER, &dma_handle);

I don't see how that ends up causing the WARNING.

Alan Stern