Re: [PATCH] usb: usbtest: reject transfer lengths the allocator cannot serve

[Alan Stern]

On Fri, Oct 16, 2026 at 05:48:48PM +0800, YuanZhe Liu wrote:
> usbtest sizes every buffer it allocates from the user supplied
> struct usbtest_param::length, but it never bounds that value.  The
> scatterlist tests, the queued bulk tests and the unlink tests pass the
> length straight to kzalloc() and usb_alloc_coherent(), so a large value
> reaches the page allocator as an allocation order above MAX_PAGE_ORDER:
> 
>     WARNING: mm/page_alloc.c:5340 at alloc_order_allowed mm/page_alloc.c:5340 [inline]
>     WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x4ae/0x1fd0 mm/page_alloc.c:5397
>     ...
>      alloc_sglist+0x331/0x500
>      usbtest_do_ioctl+0x2686/0x5880
>      usbtest_ioctl+0x440/0x720
> 
> A run of "TEST 7:  write/-7 -2147483648 sglists 3 entries
> 0..-2147483645 bytes" asks kzalloc() for more than 2 GiB.  The queued
> bulk tests reach the same warning through usb_alloc_coherent() and
> dma_direct_alloc().  The allocation fails after the warning and the
> driver then returns -ENOMEM, but the warning itself is driven by
> unvalidated user input.
> 
> Reject such lengths where the other parameter limits are already
> enforced.  KMALLOC_MAX_SIZE, that is PAGE_SIZE << MAX_PAGE_ORDER, is
> the largest contiguous allocation the page allocator is willing to
> serve, and the unaligned tests add at most one byte on top of the
> requested length.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Co-developed-by: Bin Yu <byu@xxxxxxxxxxxxx>
> Signed-off-by: Bin Yu <byu@xxxxxxxxxxxxx>
> Co-developed-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
> Signed-off-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
> Signed-off-by: YuanZhe Liu <25031212351@xxxxxxxxxxxxxxxxx>
> ---
>  drivers/usb/misc/usbtest.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
> 
> diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
> index 8759df49be28..8f2a4752b9c8 100644
> --- a/drivers/usb/misc/usbtest.c
> +++ b/drivers/usb/misc/usbtest.c
> @@ -2192,6 +2192,15 @@ usbtest_do_ioctl(struct usb_interface *intf, struct usbtest_param_32 *param)
>  		return -EINVAL;
>  	if (param->sglen > MAX_SGLEN)
>  		return -EINVAL;
> +	/*
> +	 * Every test case sizes its transfer buffers from param->length,
> +	 * using one contiguous allocation per URB or scatterlist entry.
> +	 * The page allocator cannot serve a length of KMALLOC_MAX_SIZE
> +	 * or more: the allocation order would exceed MAX_PAGE_ORDER and
> +	 * the allocator would warn before failing the allocation.
> +	 */

This comment is longer than it needs to be.  You can just say:

	/* Don't allow unreasonably large transfer-buffer allocations */

The details about contiguous allocation per URB, MAX_PAGE_ORDER, and 
allocator warnings don't really matter here.

Aside from that,

Acked-by: Alan Stern <stern@xxxxxxxxxxxxxxxxxxx>

Alan Stern

> +	if (param->length >= KMALLOC_MAX_SIZE)
> +		return -EINVAL;
>  	/*
>  	 * Just a bunch of test cases that every HCD is expected to handle.
>  	 *
> -- 
> 2.34.1