[PATCH 0/4] USB: replace page allocator calls with kmalloc()

[PATCH 0/4] USB: replace page allocator calls with kmalloc()

[Mike Rapoport (Microsoft)]

This is a (small) part of larger work of replacing page allocator calls
with kmalloc.

My initial intention a few month ago was to remove ugly casts [1], but then
willy pointed out that Linus objected to something like this [2] and it
looks like more than a decade old technical debt.

Largely, anything that doesn't need struct page (or a memdesc in the
future) should just use kmalloc() or kvmalloc() to allocate memory.
kmalloc() guarantees alignment, physical contiguity and working
virt_to_phys() and beside nicer API that returns void * on alloc and
doesn't require to know the allocation size on free, kmalloc() provides
better debugging capabilities than page allocator.

Another thing is that touching these allocation sites gives the reviewers
opportunity to see if a PAGE_SIZE buffer is actually needed or maybe
another size is appropriate.

For larger allocations that don't need physically contiguous memory
kvmalloc() can be a better option that __get_free_pages() because under
memory pressure it's is easier to allocate several order-0 pages than a
physically contiguous chunk with the same number of pages.

And last, but not least, removing needless calls to page allocator should
help with memdesc (aka project folio) conversion. There will be way less
places to audit to see if the user was actually using struct page.

The patches are deliberately kept small: each one deals with a single
driver or subsystem and with a single type of allocation, so that every
conversion can be reviewed, and if needed reverted, on its own.

[1] https://lore.kernel.org/all/20251018093002.3660549-1-rppt@kernel.org/
[2] https://lore.kernel.org/all/CA+55aFwp4iy4rtX2gE2WjBGFL=NxMVnoFeHqYa2j1dYOMMGqxg@mail.gmail.com/

Note that the buffers in usb/core/buffer.c and usb/mon/mon_bin.c are left

alone: they are mapped to userspace and thus really need struct page.

---
Mike Rapoport (Microsoft) (4):
      USB: usbfs: replace __get_free_page() with kmalloc()
      USB: cxacru: replace __get_free_page() with kmalloc()
      USB: speedtch: replace __get_free_page() with kmalloc()
      USB: serial: wwan: replace __get_free_page() with kmalloc()

 drivers/usb/atm/cxacru.c      | 16 ++++++++--------
 drivers/usb/atm/speedtch.c    |  4 ++--
 drivers/usb/core/devio.c      |  4 ++--
 drivers/usb/serial/usb_wwan.c |  6 +++---
 4 files changed, 15 insertions(+), 15 deletions(-)
---
base-commit: 1b78070aaef63512688aebfbc82365ef9d6660f1
change-id: 20260829-usb-ad052ea1ffad

--
Sincerely yours,
Mike.

[PATCH 1/4] USB: usbfs: replace __get_free_page() with kmalloc()

[Mike Rapoport (Microsoft)]

do_proc_control() allocates a temporary buffer for the data stage of a
control transfer issued from userspace.

This buffer can be allocated with kmalloc() as there's nothing special
about it to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Performance difference between kmalloc() and __get_free_pages() is not
measurable as both allocators take an object/page from a per-CPU list for
fast path allocations.

For the slow path the performance is anyway determined by the amount of
reclaim involved rather than by what allocator is used.

Replace use of __get_free_page() with kmalloc() and free_page() with
kfree().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Assisted-by: copilot:claude-opus
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 drivers/usb/core/devio.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 101cb9425480..9a7cc7cdf00b 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1190,7 +1190,7 @@ static int do_proc_control(struct usb_dev_state *ps,
 		return ret;
 
 	ret = -ENOMEM;
-	tbuf = (unsigned char *)__get_free_page(GFP_KERNEL);
+	tbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!tbuf)
 		goto done;
 	urb = usb_alloc_urb(0, GFP_NOIO);
@@ -1265,7 +1265,7 @@ static int do_proc_control(struct usb_dev_state *ps,
  done:
 	kfree(dr);
 	usb_free_urb(urb);
-	free_page((unsigned long) tbuf);
+	kfree(tbuf);
 	usbfs_decrease_memory_usage(PAGE_SIZE + sizeof(struct urb) +
 			sizeof(struct usb_ctrlrequest));
 	return ret;

-- 
2.53.0

Re: [PATCH 1/4] USB: usbfs: replace __get_free_page() with kmalloc()

[Oliver Neukum]

On 30.08.26 10:10, Mike Rapoport (Microsoft) wrote:
> do_proc_control() allocates a temporary buffer for the data stage of a
> control transfer issued from userspace.
> 
> This buffer can be allocated with kmalloc() as there's nothing special
> about it to go directly to the page allocator.

You are breaking the calculation. A page has a size of exactly
PAGE_SIZE. A kmalloced object of PAGE_SIZE is larger. That is
a bad idea.

	Regards
		Oliver

Re: [PATCH 1/4] USB: usbfs: replace __get_free_page() with kmalloc()

[Mike Rapoport]

On Mon, Aug 31, 2026 at 03:27:07PM +0200, Oliver Neukum wrote:
> On 30.08.26 10:10, Mike Rapoport (Microsoft) wrote:
> > do_proc_control() allocates a temporary buffer for the data stage of a
> > control transfer issued from userspace.
> > 
> > This buffer can be allocated with kmalloc() as there's nothing special
> > about it to go directly to the page allocator.
> 
> You are breaking the calculation. A page has a size of exactly
> PAGE_SIZE. A kmalloced object of PAGE_SIZE is larger. That is
> a bad idea.

What calculation does it break and why do you say that kmalloc(PAGE_SIZE)
gives you an object larger than PAGE_SIZE?
 
> 	Regards
> 		Oliver
> 

-- 
Sincerely yours,
Mike.

Re: [PATCH 1/4] USB: usbfs: replace __get_free_page() with kmalloc()

[Alan Stern]

On Mon, Aug 31, 2026 at 03:27:07PM +0200, Oliver Neukum wrote:
> On 30.08.26 10:10, Mike Rapoport (Microsoft) wrote:
> > do_proc_control() allocates a temporary buffer for the data stage of a
> > control transfer issued from userspace.
> > 
> > This buffer can be allocated with kmalloc() as there's nothing special
> > about it to go directly to the page allocator.
> 
> You are breaking the calculation. A page has a size of exactly
> PAGE_SIZE. A kmalloced object of PAGE_SIZE is larger. That is
> a bad idea.

By "the calculation", are you referring to the 
usbfs_increase_memory_usage() call in do_proc_control()?

The overhead in kmalloc allocations doesn't really matter for this 
purpose -- it can be considered a rounding error.  Besides, we don't 
know how big the overhead is, so we can't account for it.  You can see 
that in the same call, we don't try to account for the overhead involved 
in usb_alloc_urb() or kmalloc_obj() either.

I'd say there's nothing wrong with this patch.

Alan Stern

Re: [PATCH 1/4] USB: usbfs: replace __get_free_page() with kmalloc()

[Vlastimil Babka (SUSE)]

On 8/31/26 16:30, Alan Stern wrote:
> On Mon, Aug 31, 2026 at 03:27:07PM +0200, Oliver Neukum wrote:
>> On 30.08.26 10:10, Mike Rapoport (Microsoft) wrote:
>> > do_proc_control() allocates a temporary buffer for the data stage of a
>> > control transfer issued from userspace.
>> > 
>> > This buffer can be allocated with kmalloc() as there's nothing special
>> > about it to go directly to the page allocator.
>> 
>> You are breaking the calculation. A page has a size of exactly
>> PAGE_SIZE. A kmalloced object of PAGE_SIZE is larger. That is
>> a bad idea.
> 
> By "the calculation", are you referring to the 
> usbfs_increase_memory_usage() call in do_proc_control()?
> 
> The overhead in kmalloc allocations doesn't really matter for this 
> purpose -- it can be considered a rounding error.

FWIW, the overhead will be zero for a PAGE_SIZE size, unless slab debugging
is enabled, but you can ignore it.

>  Besides, we don't 
> know how big the overhead is, so we can't account for it.  You can see 
> that in the same call, we don't try to account for the overhead involved 
> in usb_alloc_urb() or kmalloc_obj() either.

ksize() exists but I wouldn't bother indeed.

> I'd say there's nothing wrong with this patch.

Agreed.

> Alan Stern

[PATCH 2/4] USB: cxacru: replace __get_free_page() with kmalloc()

[Mike Rapoport (Microsoft)]

cxacru_fw() allocates a temporary buffer used to feed the firmware to the
device and cxacru_bind() allocates the transfer buffers for the command
URBs.

These buffers can be allocated with kmalloc() as there's nothing special
about them to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Performance difference between kmalloc() and __get_free_pages() is not
measurable as both allocators take an object/page from a per-CPU list for
fast path allocations.

For the slow path the performance is anyway determined by the amount of
reclaim involved rather than by what allocator is used.

Replace use of __get_free_page() with kmalloc() and free_page() with
kfree().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Assisted-by: copilot:claude-opus
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 drivers/usb/atm/cxacru.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
index 636f7886fc26..75d87c31e81f 100644
--- a/drivers/usb/atm/cxacru.c
+++ b/drivers/usb/atm/cxacru.c
@@ -942,7 +942,7 @@ static int cxacru_fw(struct usb_device *usb_dev, enum cxacru_fw_request fw,
 	int offd, offb;
 	const int stride = CMD_PACKET_SIZE - 8;
 
-	buf = (u8 *) __get_free_page(GFP_KERNEL);
+	buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
 
@@ -978,7 +978,7 @@ static int cxacru_fw(struct usb_device *usb_dev, enum cxacru_fw_request fw,
 	ret = 0;
 
 cleanup:
-	free_page((unsigned long) buf);
+	kfree(buf);
 	return ret;
 }
 
@@ -1146,13 +1146,13 @@ static int cxacru_bind(struct usbatm_data *usbatm_instance,
 
 	mutex_init(&instance->adsl_state_serialize);
 
-	instance->rcv_buf = (u8 *) __get_free_page(GFP_KERNEL);
+	instance->rcv_buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!instance->rcv_buf) {
 		usb_dbg(usbatm_instance, "cxacru_bind: no memory for rcv_buf\n");
 		ret = -ENOMEM;
 		goto fail;
 	}
-	instance->snd_buf = (u8 *) __get_free_page(GFP_KERNEL);
+	instance->snd_buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!instance->snd_buf) {
 		usb_dbg(usbatm_instance, "cxacru_bind: no memory for snd_buf\n");
 		ret = -ENOMEM;
@@ -1220,8 +1220,8 @@ static int cxacru_bind(struct usbatm_data *usbatm_instance,
 	return 0;
 
  fail:
-	free_page((unsigned long) instance->snd_buf);
-	free_page((unsigned long) instance->rcv_buf);
+	kfree(instance->snd_buf);
+	kfree(instance->rcv_buf);
 	usb_free_urb(instance->snd_urb);
 	usb_free_urb(instance->rcv_urb);
 	kfree(instance);
@@ -1254,8 +1254,8 @@ static void cxacru_unbind(struct usbatm_data *usbatm_instance,
 	usb_free_urb(instance->snd_urb);
 	usb_free_urb(instance->rcv_urb);
 
-	free_page((unsigned long) instance->snd_buf);
-	free_page((unsigned long) instance->rcv_buf);
+	kfree(instance->snd_buf);
+	kfree(instance->rcv_buf);
 
 	kfree(instance);
 

-- 
2.53.0

[PATCH 3/4] USB: speedtch: replace __get_free_page() with kmalloc()

[Mike Rapoport (Microsoft)]

speedtch_upload_firmware() allocates a temporary buffer used to feed the
firmware to the device.

This buffer can be allocated with kmalloc() as there's nothing special
about it to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Performance difference between kmalloc() and __get_free_pages() is not
measurable as both allocators take an object/page from a per-CPU list for
fast path allocations.

For the slow path the performance is anyway determined by the amount of
reclaim involved rather than by what allocator is used.

Replace use of __get_free_page() with kmalloc() and free_page() with
kfree().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Assisted-by: copilot:claude-opus
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 drivers/usb/atm/speedtch.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/usb/atm/speedtch.c b/drivers/usb/atm/speedtch.c
index 9d28c652bcd8..e5e021aafbd3 100644
--- a/drivers/usb/atm/speedtch.c
+++ b/drivers/usb/atm/speedtch.c
@@ -241,7 +241,7 @@ static int speedtch_upload_firmware(struct speedtch_instance_data *instance,
 
 	usb_dbg(usbatm, "%s entered\n", __func__);
 
-	buffer = (unsigned char *)__get_free_page(GFP_KERNEL);
+	buffer = kmalloc(PAGE_SIZE, GFP_KERNEL);
 	if (!buffer) {
 		ret = -ENOMEM;
 		usb_dbg(usbatm, "%s: no memory for buffer!\n", __func__);
@@ -340,7 +340,7 @@ static int speedtch_upload_firmware(struct speedtch_instance_data *instance,
 	ret = 0;
 
 out_free:
-	free_page((unsigned long)buffer);
+	kfree(buffer);
 out:
 	return ret;
 }

-- 
2.53.0

[PATCH 4/4] USB: serial: wwan: replace __get_free_page() with kmalloc()

[Mike Rapoport (Microsoft)]

usb_wwan_port_probe() allocates the transfer buffers for the read URBs.

These buffers can be allocated with kmalloc() as there's nothing special
about them to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and
kfree() does not need to know the size of the freed object.

Performance difference between kmalloc() and __get_free_pages() is not
measurable as both allocators take an object/page from a per-CPU list for
fast path allocations.

For the slow path the performance is anyway determined by the amount of
reclaim involved rather than by what allocator is used.

While on it, allocate IN_BUFLEN bytes rather than a full page. IN_BUFLEN
is the transfer_buffer_length of the read URBs, the page allocator was
only used because IN_BUFLEN happens to equal PAGE_SIZE on x86.

Replace use of __get_free_page() with kmalloc() and free_page() with
kfree().

Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Assisted-by: copilot:claude-opus
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 drivers/usb/serial/usb_wwan.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index a183cc4515ed..a3929d3a3ec1 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -455,7 +455,7 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
 	init_usb_anchor(&portdata->delayed);
 
 	for (i = 0; i < N_IN_URB; i++) {
-		buffer = (u8 *)__get_free_page(GFP_KERNEL);
+		buffer = kmalloc(IN_BUFLEN, GFP_KERNEL);
 		if (!buffer)
 			goto bail_out_error;
 		portdata->in_buffer[i] = buffer;
@@ -492,7 +492,7 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
 bail_out_error:
 	for (i = 0; i < N_IN_URB; i++) {
 		usb_free_urb(portdata->in_urbs[i]);
-		free_page((unsigned long)portdata->in_buffer[i]);
+		kfree(portdata->in_buffer[i]);
 	}
 	kfree(portdata);
 
@@ -510,7 +510,7 @@ void usb_wwan_port_remove(struct usb_serial_port *port)
 
 	for (i = 0; i < N_IN_URB; i++) {
 		usb_free_urb(portdata->in_urbs[i]);
-		free_page((unsigned long)portdata->in_buffer[i]);
+		kfree(portdata->in_buffer[i]);
 	}
 	for (i = 0; i < N_OUT_URB; i++) {
 		usb_free_urb(portdata->out_urbs[i]);

-- 
2.53.0

Re: [PATCH 0/4] USB: replace page allocator calls with kmalloc()

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Sun, 30 Aug 2026 11:10:36 +0300 you wrote:
> This is a (small) part of larger work of replacing page allocator calls
> with kmalloc.
> 
> My initial intention a few month ago was to remove ugly casts [1], but then
> willy pointed out that Linus objected to something like this [2] and it
> looks like more than a decade old technical debt.
> 
> [...]

Here is the summary with links:
  - [1/4] USB: usbfs: replace __get_free_page() with kmalloc()
    (no matching commit)
  - [2/4] USB: cxacru: replace __get_free_page() with kmalloc()
    https://git.kernel.org/netdev/net-next/c/a3b4826138d4
  - [3/4] USB: speedtch: replace __get_free_page() with kmalloc()
    https://git.kernel.org/netdev/net-next/c/534b18813974
  - [4/4] USB: serial: wwan: replace __get_free_page() with kmalloc()
    (no matching commit)

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH 0/4] USB: replace page allocator calls with kmalloc()

[Johan Hovold]

On Thu, Sep 03, 2026 at 02:00:11AM +0000, patchwork-bot+netdevbpf@kernel.org wrote:
> Hello:
> 
> This series was applied to netdev/net-next.git (main)
> by Jakub Kicinski <kuba@kernel.org>:
> 
> On Sun, 30 Aug 2026 11:10:36 +0300 you wrote:
> > This is a (small) part of larger work of replacing page allocator calls
> > with kmalloc.
> > 
> > My initial intention a few month ago was to remove ugly casts [1], but then
> > willy pointed out that Linus objected to something like this [2] and it
> > looks like more than a decade old technical debt.
> > 
> > [...]
> 
> Here is the summary with links:
>   - [1/4] USB: usbfs: replace __get_free_page() with kmalloc()
>     (no matching commit)
>   - [2/4] USB: cxacru: replace __get_free_page() with kmalloc()
>     https://git.kernel.org/netdev/net-next/c/a3b4826138d4
>   - [3/4] USB: speedtch: replace __get_free_page() with kmalloc()
>     https://git.kernel.org/netdev/net-next/c/534b18813974
>   - [4/4] USB: serial: wwan: replace __get_free_page() with kmalloc()
>     (no matching commit)

Why were these USB patches applies to net-next?

Johan

Re: [PATCH 0/4] USB: replace page allocator calls with kmalloc()

[Johan Hovold]

On Thu, Sep 03, 2026 at 08:20:58AM +0200, Johan Hovold wrote:
> On Thu, Sep 03, 2026 at 02:00:11AM +0000, patchwork-bot+netdevbpf@kernel.org wrote:
> > Hello:
> > 
> > This series was applied to netdev/net-next.git (main)
> > by Jakub Kicinski <kuba@kernel.org>:
> > 
> > On Sun, 30 Aug 2026 11:10:36 +0300 you wrote:
> > > This is a (small) part of larger work of replacing page allocator calls
> > > with kmalloc.
> > > 
> > > My initial intention a few month ago was to remove ugly casts [1], but then
> > > willy pointed out that Linus objected to something like this [2] and it
> > > looks like more than a decade old technical debt.
> > > 
> > > [...]
> > 
> > Here is the summary with links:
> >   - [1/4] USB: usbfs: replace __get_free_page() with kmalloc()
> >     (no matching commit)
> >   - [2/4] USB: cxacru: replace __get_free_page() with kmalloc()
> >     https://git.kernel.org/netdev/net-next/c/a3b4826138d4
> >   - [3/4] USB: speedtch: replace __get_free_page() with kmalloc()
> >     https://git.kernel.org/netdev/net-next/c/534b18813974
> >   - [4/4] USB: serial: wwan: replace __get_free_page() with kmalloc()
> >     (no matching commit)
> 
> Why were these USB patches applies to net-next?

I see now that it was only the ATM ones.

Sorry about the noise.
 
Johan

Re: [PATCH 0/4] USB: replace page allocator calls with kmalloc()

[Jakub Kicinski]

On Thu, 3 Sep 2026 12:54:42 +0200 Johan Hovold wrote:
> On Thu, Sep 03, 2026 at 08:20:58AM +0200, Johan Hovold wrote:
> > > Here is the summary with links:
> > >   - [1/4] USB: usbfs: replace __get_free_page() with kmalloc()
> > >     (no matching commit)
> > >   - [2/4] USB: cxacru: replace __get_free_page() with kmalloc()
> > >     https://git.kernel.org/netdev/net-next/c/a3b4826138d4
> > >   - [3/4] USB: speedtch: replace __get_free_page() with kmalloc()
> > >     https://git.kernel.org/netdev/net-next/c/534b18813974
> > >   - [4/4] USB: serial: wwan: replace __get_free_page() with kmalloc()
> > >     (no matching commit)  
> > 
> > Why were these USB patches applies to net-next?  
> 
> I see now that it was only the ATM ones.
> 
> Sorry about the noise.

Sorry, should have sent a note.