Re: KASAN: slab-out-of-bounds Read in handle_vmptrld

Alan Stern
2019-09-13T15:36:32Z

On Fri, 13 Sep 2019, Paolo Bonzini wrote:

> On 13/09/19 15:02, Greg Kroah-Hartman wrote:
> > Look at linux-next, we "should" have fixed up hcd_buffer_alloc() now to
> > not need this type of thing. If we got it wrong, please let us know and
> > then yes, a fix like this would be most appreciated :)
>
> I still see
>
> /* some USB hosts just use PIO */
> if (!hcd_uses_dma(hcd)) {
> *dma = ~(dma_addr_t) 0;
> return kmalloc(size, mem_flags);
> }
>
> in linux-next's hcd_buffer_alloc and also in usb.git's usb-next branch.
> I also see the same
>
> if (remap_pfn_range(vma, vma->vm_start,
> virt_to_phys(usbm->mem) >> PAGE_SHIFT,
> size, vma->vm_page_prot) < 0) {
> ...
> }
>
> in usbdev_mmap. Of course it's possible that I'm looking at the wrong
> branch, or just being dense.

Have you seen

https://marc.info/?l=linux-usb&m=156758511218419&w=2

? It certainly is relevant, although Greg hasn't replied to it.

There have been other messages on the mailing list about this issue,
but I haven't tried to keep track of them.

Also, just warning about a non-page-aligned allocation doesn't really
help. It would be better to fix the misbehaving allocator.

Alan Stern