From: Pavel Skripkin <paskrip...@gmail.com> Date: Mon, 1 Mar 2021 02:22:40 +0300
> syzbot found WARNING in __alloc_pages_nodemask()[1] when order >= MAX_ORDER. > It was caused by a huge length value passed from userspace to > qrtr_tun_write_iter(), > which tries to allocate skb. Since the value comes from the untrusted source > there is no need to raise a warning in __alloc_pages_nodemask(). > > [1] WARNING in __alloc_pages_nodemask+0x5f8/0x730 mm/page_alloc.c:5014 > Call Trace: > __alloc_pages include/linux/gfp.h:511 [inline] > __alloc_pages_node include/linux/gfp.h:524 [inline] > alloc_pages_node include/linux/gfp.h:538 [inline] > kmalloc_large_node+0x60/0x110 mm/slub.c:3999 > __kmalloc_node_track_caller+0x319/0x3f0 mm/slub.c:4496 > __kmalloc_reserve net/core/skbuff.c:150 [inline] > __alloc_skb+0x4e4/0x5a0 net/core/skbuff.c:210 > __netdev_alloc_skb+0x70/0x400 net/core/skbuff.c:446 > netdev_alloc_skb include/linux/skbuff.h:2832 [inline] > qrtr_endpoint_post+0x84/0x11b0 net/qrtr/qrtr.c:442 > qrtr_tun_write_iter+0x11f/0x1a0 net/qrtr/tun.c:98 > call_write_iter include/linux/fs.h:1901 [inline] > new_sync_write+0x426/0x650 fs/read_write.c:518 > vfs_write+0x791/0xa30 fs/read_write.c:605 > ksys_write+0x12d/0x250 fs/read_write.c:658 > do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 > entry_SYSCALL_64_after_hwframe+0x44/0xa9 > > Reported-by: syzbot+80dccaee7c6630fa9...@syzkaller.appspotmail.com > Signed-off-by: Pavel Skripkin <paskrip...@gmail.com> Acked-by: Alexander Lobakin <aloba...@pm.me> Thanks! > --- > net/qrtr/qrtr.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c > index b34358282f37..82d2eb8c21d1 100644 > --- a/net/qrtr/qrtr.c > +++ b/net/qrtr/qrtr.c > @@ -439,7 +439,7 @@ int qrtr_endpoint_post(struct qrtr_endpoint *ep, const > void *data, size_t len) > if (len == 0 || len & 3) > return -EINVAL; > > - skb = netdev_alloc_skb(NULL, len); > + skb = __netdev_alloc_skb(NULL, len, GFP_ATOMIC | __GFP_NOWARN); > if (!skb) > return -ENOMEM; > > -- > 2.25.1 Al
