[PATCH] usb: usbtest: reject transfer lengths the allocator cannot serve

[YuanZhe Liu]

usbtest sizes every buffer it allocates from the user supplied
struct usbtest_param::length, but it never bounds that value.  The
scatterlist tests, the queued bulk tests and the unlink tests pass the
length straight to kzalloc() and usb_alloc_coherent(), so a large value
reaches the page allocator as an allocation order above MAX_PAGE_ORDER:

    WARNING: mm/page_alloc.c:5340 at alloc_order_allowed mm/page_alloc.c:5340 [inline]
    WARNING: mm/page_alloc.c:5340 at __alloc_frozen_pages_noprof+0x4ae/0x1fd0 mm/page_alloc.c:5397
    ...
     alloc_sglist+0x331/0x500
     usbtest_do_ioctl+0x2686/0x5880
     usbtest_ioctl+0x440/0x720

A run of "TEST 7:  write/-7 -2147483648 sglists 3 entries
0..-2147483645 bytes" asks kzalloc() for more than 2 GiB.  The queued
bulk tests reach the same warning through usb_alloc_coherent() and
dma_direct_alloc().  The allocation fails after the warning and the
driver then returns -ENOMEM, but the warning itself is driven by
unvalidated user input.

Reject such lengths where the other parameter limits are already
enforced.  KMALLOC_MAX_SIZE, that is PAGE_SIZE << MAX_PAGE_ORDER, is
the largest contiguous allocation the page allocator is willing to
serve, and the unaligned tests add at most one byte on top of the
requested length.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Co-developed-by: Bin Yu <byu@xxxxxxxxxxxxx>
Signed-off-by: Bin Yu <byu@xxxxxxxxxxxxx>
Co-developed-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
Signed-off-by: Cheng Wen <wencheng@xxxxxxxxxxxxx>
Signed-off-by: YuanZhe Liu <25031212351@xxxxxxxxxxxxxxxxx>
---
 drivers/usb/misc/usbtest.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 8759df49be28..8f2a4752b9c8 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -2192,6 +2192,15 @@ usbtest_do_ioctl(struct usb_interface *intf, struct usbtest_param_32 *param)
 		return -EINVAL;
 	if (param->sglen > MAX_SGLEN)
 		return -EINVAL;
+	/*
+	 * Every test case sizes its transfer buffers from param->length,
+	 * using one contiguous allocation per URB or scatterlist entry.
+	 * The page allocator cannot serve a length of KMALLOC_MAX_SIZE
+	 * or more: the allocation order would exceed MAX_PAGE_ORDER and
+	 * the allocator would warn before failing the allocation.
+	 */
+	if (param->length >= KMALLOC_MAX_SIZE)
+		return -EINVAL;
 	/*
 	 * Just a bunch of test cases that every HCD is expected to handle.
 	 *
-- 
2.34.1