From: Willem de Bruijn <willemdebruijn.kernel@gmail.com>
To: Eric Dumazet <edumazet@google.com>,
"David S . Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>,
Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org, eric.dumazet@gmail.com,
Eric Dumazet <edumazet@google.com>,
syzbot+c5da1f087c9e4ec6c933@syzkaller.appspotmail.com,
Willem de Bruijn <willemb@google.com>
Subject: Re: [PATCH net] ppp_async: limit MRU to 64K
Date: Mon, 05 Feb 2024 13:59:40 -0500 [thread overview]
Message-ID: <65c1301c2fc9c_7b2e029449@willemb.c.googlers.com.notmuch> (raw)
In-Reply-To: <20240205171004.1059724-1-edumazet@google.com>
Eric Dumazet wrote:
> syzbot triggered a warning [1] in __alloc_pages():
>
> WARN_ON_ONCE_GFP(order > MAX_PAGE_ORDER, gfp)
>
> Willem fixed a similar issue in commit c0a2a1b0d631 ("ppp: limit MRU to 64K")
>
> Adopt the same sanity check for ppp_async_ioctl(PPPIOCSMRU)
>
> [1]:
>
> WARNING: CPU: 1 PID: 11 at mm/page_alloc.c:4543 __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
> Modules linked in:
> CPU: 1 PID: 11 Comm: kworker/u4:0 Not tainted 6.8.0-rc2-syzkaller-g41bccc98fb79 #0
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
> Workqueue: events_unbound flush_to_ldisc
> pstate: 204000c5 (nzCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
> pc : __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
> lr : __alloc_pages+0xc8/0x698 mm/page_alloc.c:4537
> sp : ffff800093967580
> x29: ffff800093967660 x28: ffff8000939675a0 x27: dfff800000000000
> x26: ffff70001272ceb4 x25: 0000000000000000 x24: ffff8000939675c0
> x23: 0000000000000000 x22: 0000000000060820 x21: 1ffff0001272ceb8
> x20: ffff8000939675e0 x19: 0000000000000010 x18: ffff800093967120
> x17: ffff800083bded5c x16: ffff80008ac97500 x15: 0000000000000005
> x14: 1ffff0001272cebc x13: 0000000000000000 x12: 0000000000000000
> x11: ffff70001272cec1 x10: 1ffff0001272cec0 x9 : 0000000000000001
> x8 : ffff800091c91000 x7 : 0000000000000000 x6 : 000000000000003f
> x5 : 00000000ffffffff x4 : 0000000000000000 x3 : 0000000000000020
> x2 : 0000000000000008 x1 : 0000000000000000 x0 : ffff8000939675e0
> Call trace:
> __alloc_pages+0x308/0x698 mm/page_alloc.c:4543
> __alloc_pages_node include/linux/gfp.h:238 [inline]
> alloc_pages_node include/linux/gfp.h:261 [inline]
> __kmalloc_large_node+0xbc/0x1fc mm/slub.c:3926
> __do_kmalloc_node mm/slub.c:3969 [inline]
> __kmalloc_node_track_caller+0x418/0x620 mm/slub.c:4001
> kmalloc_reserve+0x17c/0x23c net/core/skbuff.c:590
> __alloc_skb+0x1c8/0x3d8 net/core/skbuff.c:651
> __netdev_alloc_skb+0xb8/0x3e8 net/core/skbuff.c:715
> netdev_alloc_skb include/linux/skbuff.h:3235 [inline]
> dev_alloc_skb include/linux/skbuff.h:3248 [inline]
> ppp_async_input drivers/net/ppp/ppp_async.c:863 [inline]
> ppp_asynctty_receive+0x588/0x186c drivers/net/ppp/ppp_async.c:341
> tty_ldisc_receive_buf+0x12c/0x15c drivers/tty/tty_buffer.c:390
> tty_port_default_receive_buf+0x74/0xac drivers/tty/tty_port.c:37
> receive_buf drivers/tty/tty_buffer.c:444 [inline]
> flush_to_ldisc+0x284/0x6e4 drivers/tty/tty_buffer.c:494
> process_one_work+0x694/0x1204 kernel/workqueue.c:2633
> process_scheduled_works kernel/workqueue.c:2706 [inline]
> worker_thread+0x938/0xef4 kernel/workqueue.c:2787
> kthread+0x288/0x310 kernel/kthread.c:388
> ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:860
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-and-tested-by: syzbot+c5da1f087c9e4ec6c933@syzkaller.appspotmail.com
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Cc: Willem de Bruijn <willemb@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
next prev parent reply other threads:[~2024-02-05 18:59 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-05 17:10 [PATCH net] ppp_async: limit MRU to 64K Eric Dumazet
2024-02-05 18:59 ` Willem de Bruijn [this message]
-- strict thread matches above, loose matches on Subject: below --
2024-02-06 14:42 [PATCH v4 net-next 00/15] net: more factorization in cleanup_net() paths Eric Dumazet
2024-02-06 14:42 ` [PATCH net] ppp_async: limit MRU to 64K Eric Dumazet
2024-02-06 16:50 ` Eric Dumazet
2024-02-07 3:00 ` patchwork-bot+netdevbpf
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=65c1301c2fc9c_7b2e029449@willemb.c.googlers.com.notmuch \
--to=willemdebruijn.kernel@gmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=eric.dumazet@gmail.com \
--cc=kuba@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzbot+c5da1f087c9e4ec6c933@syzkaller.appspotmail.com \
--cc=willemb@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox