Re: [syzbot] [mm?] WARNING in ep_write_iter

["Zi Yan" <ziy@nvidia.com>]

+Vlastimil

On Thu Aug 20, 2026 at 9:55 AM EDT, Zi Yan wrote:
> On Sun Aug 16, 2026 at 4:52 PM EDT, Andrew Morton wrote:
>> On Sun, 16 Aug 2026 12:25:48 -0700 syzbot <syzbot+805630f1453e490427fa@syzkaller.appspotmail.com> wrote:
>>
>>> Hello,
>>> 
>>> syzbot found the following issue on:
>>> 
>>> HEAD commit:    3d6d817622b0 Merge tag 'scsi-fixes' of git://git.kernel.or..
>>> git tree:       upstream
>>> console output: https://syzkaller.appspot.com/x/log.txt?x=15927479580000
>>> kernel config:  https://syzkaller.appspot.com/x/.config?x=a59830cba91a1981
>>> dashboard link: https://syzkaller.appspot.com/bug?extid=805630f1453e490427fa
>>> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
>>> 
>>> Unfortunately, I don't have any reproducer for this issue yet.
>>> 
>>> Downloadable assets:
>>> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-3d6d8176.raw.xz
>>> vmlinux: https://storage.googleapis.com/syzbot-assets/d19e0514c02a/vmlinux-3d6d8176.xz
>>> kernel image: https://storage.googleapis.com/syzbot-assets/f6da706811f4/bzImage-3d6d8176.xz
>>> 
>>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
>>> Reported-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com
>>> 
>>> gadgetfs: bound to dummy_udc driver
>>> ------------[ cut here ]------------
>>> 1
>>> WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x2ce/0x380 mm/page_alloc.c:5280, CPU#0: syz.0.0/5319
>>
>> Thanks.  drivers/usb/gadget is the offender.
>>
>> Gemini sums it up well.  "ep_write_iter() needs a bounds check prior to
>> memory allocation".  https://share.gemini.google/5NzjyttO0ULc
>>
>> I expect an easy fix would be
>>
>> --- a/drivers/usb/gadget/legacy/inode.c~a
>> +++ a/drivers/usb/gadget/legacy/inode.c
>> @@ -666,7 +666,7 @@ ep_write_iter(struct kiocb *iocb, struct
>>  		return -EBADMSG;
>>  	}
>>  
>> -	buf = kmalloc(len, GFP_KERNEL);
>> +	buf = kmalloc(len, GFP_KERNEL|__GFP_NOWARN);
>>  	if (unlikely(!buf)) {
>>  		mutex_unlock(&epdata->lock);
>>  		return -ENOMEM;
>>
>> or do what Gemini said.  Me, I'll add some cc's and run away.
>
> Let’s do this instead of suppressing kmalloc WARNs. Since a similar WARN[1]
> showed up yesterday and that WARN is better handled by a bound check,
> I do not think we want to lose the WARN from kmalloc/the page allocator.
>
> [1] https://lore.kernel.org/all/6a863306.ae6ddae5.3da009.0013.GAE@google.com/
>
> Like the patch below:
>
> From 732ea7074854ac3495bbceb274cdd01966118e57 Mon Sep 17 00:00:00 2001
> From: Zi Yan <ziy@nvidia.com>
> Date: Thu, 20 Aug 2026 09:19:12 -0400
> Subject: [PATCH] USB: gadgetfs: do not WARN about excessively large memory
>  allocations
>
> GadgetFS passes an excessively large user input len to kmalloc and kmalloc
> gives a WARN (see below for details). Suppress it by passing __GFP_NOWARN
> to kmalloc used by both ep_write_iter() and ep_read_iter(). Follow the same
> method as commit 4f2629ea67e72 ("USB: usbfs: Don't WARN about excessively
> large memory allocations").
>
> kmalloc is used to allocate physically contiguous memory for kernel
> allocations. For requests larger than KMALLOC_MAX_CACHE_SIZE, kmalloc uses
> the page allocator and can only support up to KMALLOC_MAX_SIZE. For request
> sizes bigger than KMALLOC_MAX_SIZE, the page allocator can emit a WARN
> because kmalloc allocates an order greater than MAX_PAGE_ORDER.
>
> Fixes: b3c466ce5129 ("page allocator: do not sanity check order in the fast path")
> Reported-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/all/6a820ebc.9ebadd4d.20b15e.001b.GAE@google.com/
> Tested-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com
> Signed-off-by: Zi Yan <ziy@nvidia.com>
> Cc: stable@vger.kernel.org
> ---
>  drivers/usb/gadget/legacy/inode.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
> index d87a8ab515107..278a0a2b39f4c 100644
> --- a/drivers/usb/gadget/legacy/inode.c
> +++ b/drivers/usb/gadget/legacy/inode.c
> @@ -604,7 +604,7 @@ ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
>  		return -EBADMSG;
>  	}
>  
> -	buf = kmalloc(len, GFP_KERNEL);
> +	buf = kmalloc(len, GFP_KERNEL | __GFP_NOWARN);
>  	if (unlikely(!buf)) {
>  		mutex_unlock(&epdata->lock);
>  		return -ENOMEM;
> @@ -666,7 +666,7 @@ ep_write_iter(struct kiocb *iocb, struct iov_iter *from)
>  		return -EBADMSG;
>  	}
>  
> -	buf = kmalloc(len, GFP_KERNEL);
> +	buf = kmalloc(len, GFP_KERNEL | __GFP_NOWARN);
>  	if (unlikely(!buf)) {
>  		mutex_unlock(&epdata->lock);
>  		return -ENOMEM;




-- 
Best Regards,
Yan, Zi