mirror of
https://kernel.googlesource.com/pub/scm/linux/kernel/git/torvalds/linux
synced 2025-10-01 13:20:36 +10:00
0143d148d1
The current implementation of usbdev_mmap uses usb_alloc_coherent to allocate memory pages that will later be mapped into the user space. Meanwhile, usb_alloc_coherent employs three different methods to allocate memory, as outlined below: * If hcd->localmem_pool is non-null, it uses gen_pool_dma_alloc to allocate memory; * If DMA is not available, it uses kmalloc to allocate memory; * Otherwise, it uses dma_alloc_coherent. However, it should be noted that gen_pool_dma_alloc does not guarantee that the resulting memory will be page-aligned. Furthermore, trying to map slab pages (i.e., memory allocated by kmalloc) into the user space is not resonable and can lead to problems, such as a type confusion bug when PAGE_TABLE_CHECK=y [1]. To address these issues, this patch introduces hcd_alloc_coherent_pages, which addresses the above two problems. Specifically, hcd_alloc_coherent_pages uses gen_pool_dma_alloc_align instead of gen_pool_dma_alloc to ensure that the memory is page-aligned. To replace kmalloc, hcd_alloc_coherent_pages directly allocates pages by calling __get_free_pages. Reported-by: syzbot+fcf1a817ceb50935ce99@syzkaller.appspotmail.comm Closes: https://lore.kernel.org/lkml/000000000000258e5e05fae79fc1@google.com/ [1] Fixes: |
||
|---|---|---|
| .. | ||
| audio-v2.h | ||
| audio-v3.h | ||
| audio.h | ||
| c67x00.h | ||
| ccid.h | ||
| cdc_ncm.h | ||
| cdc-wdm.h | ||
| cdc.h | ||
| ch9.h | ||
| chipidea.h | ||
| composite.h | ||
| ehci_def.h | ||
| ehci_pdriver.h | ||
| ehci-dbgp.h | ||
| ezusb.h | ||
| functionfs.h | ||
| g_hid.h | ||
| gadget_configfs.h | ||
| gadget.h | ||
| hcd.h | ||
| input.h | ||
| iowarrior.h | ||
| irda.h | ||
| isp116x.h | ||
| isp1301.h | ||
| isp1362.h | ||
| m66592.h | ||
| musb-ux500.h | ||
| musb.h | ||
| net2280.h | ||
| of.h | ||
| ohci_pdriver.h | ||
| onboard_hub.h | ||
| otg-fsm.h | ||
| otg.h | ||
| pd_ado.h | ||
| pd_bdo.h | ||
| pd_ext_sdb.h | ||
| pd_vdo.h | ||
| pd.h | ||
| phy_companion.h | ||
| phy.h | ||
| quirks.h | ||
| r8a66597.h | ||
| r8152.h | ||
| renesas_usbhs.h | ||
| rndis_host.h | ||
| role.h | ||
| rzv2m_usb3drd.h | ||
| serial.h | ||
| sl811.h | ||
| storage.h | ||
| tcpci.h | ||
| tcpm.h | ||
| tegra_usb_phy.h | ||
| typec_altmode.h | ||
| typec_dp.h | ||
| typec_mux.h | ||
| typec_retimer.h | ||
| typec_tbt.h | ||
| typec.h | ||
| uas.h | ||
| ulpi.h | ||
| usb338x.h | ||
| usb_phy_generic.h | ||
| usbnet.h | ||
| uvc.h | ||
| webusb.h | ||
| xhci-dbgp.h | ||