[lvc-project] [PATCH] usb: gadget: f_fs: use __GFP_NOWARN for user-controlled buffer allocation

[Vasiliy Kovalev]

ffs_alloc_buffer() passes iov_iter_count() of a userspace read(2) or
write(2) buffer directly to kmalloc() when the UDC does not support
scatter-gather (gadget->sg_supported == false). There is no upper
bound imposed on data_len before it reaches kmalloc().

If a userspace program issues a read/write large enough that the
resulting order exceeds the page allocator's MAX_PAGE_ORDER, kmalloc()
routes to the page allocator which triggers a WARN_ON_ONCE before
returning NULL. The allocation failure is already handled correctly
via -ENOMEM in ffs_epfile_io(), so the WARN carries no additional
diagnostic value. On systems booted with panic_on_warn=1 this WARN
becomes fatal.

Use __GFP_NOWARN so oversized allocations quietly fall back to
-ENOMEM, matching the existing error path.

Found by Linux Verification Center (linuxtesting.org) with Svace static
analysis tool.

Fixes: ddf8abd25994 ("USB: f_fs: the FunctionFS driver")
Cc: stable at vger.kernel.org
Signed-off-by: Vasiliy Kovalev <kovalev at altlinux.org>
---
 drivers/usb/gadget/function/f_fs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 44218be1e676..e44b441b844b 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -843,7 +843,7 @@ static inline void *ffs_alloc_buffer(struct ffs_io_data *io_data,
 	if (io_data->use_sg)
 		return ffs_build_sg_list(&io_data->sgt, data_len);
 
-	return kmalloc(data_len, GFP_KERNEL);
+	return kmalloc(data_len, GFP_KERNEL | __GFP_NOWARN);
 }
 
 static inline void ffs_free_buffer(struct ffs_io_data *io_data)
-- 
2.50.1