Re: [PATCH] usb: usbtest: reject transfer lengths the allocator cannot serve

[sashiko-bot@kernel.org]

> usbtest sizes every buffer it allocates from the user supplied
> struct usbtest_param::length, but it never bounds that value.  The
> scatterlist tests, the queued bulk tests and the unlink tests pass the
> length straight to kzalloc() and usb_alloc_coherent(), so a large value
> reaches the page allocator as an allocation order above MAX_PAGE_ORDER:
> 
>     WARNING: mm/page_alloc.c:5340 at alloc_order_allowed mm/page_alloc.c:5340 [inline]
>     WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x4ae/0x1fd0 mm/page_alloc.c:5397
>     ...
>      alloc_sglist+0x331/0x500
>      usbtest_do_ioctl+0x2686/0x5880
>      usbtest_ioctl+0x440/0x720
> 
> A run of "TEST 7:  write/-7 -2147483648 sglists 3 entries
> 0..-2147483645 bytes" asks kzalloc() for more than 2 GiB.  The queued
> [ ... ]
> Co-developed-by: Bin Yu <byu@xidian.edu.cn>
> Signed-off-by: Bin Yu <byu@xidian.edu.cn>
> Co-developed-by: Cheng Wen <wencheng@xidian.edu.cn>
> Signed-off-by: Cheng Wen <wencheng@xidian.edu.cn>
> Signed-off-by: YuanZhe Liu <25031212351@stu.xidian.edu.cn>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261016094848.38533-1-25031212351@stu.xidian.edu.cn?part=1