Re: [syzbot] [mm?] WARNING in ep_write_iter

On Thu, Aug 20, 2026 at 09:59:27AM -0400, Zi Yan wrote:
> +Vlastimil
> 
> On Thu Aug 20, 2026 at 9:55 AM EDT, Zi Yan wrote:
> > On Sun Aug 16, 2026 at 4:52 PM EDT, Andrew Morton wrote:
> >> On Sun, 16 Aug 2026 12:25:48 -0700 syzbot <[email protected]> wrote:
> >>
> >>> Hello,
> >>> 
> >>> syzbot found the following issue on:
> >>> 
> >>> HEAD commit:    3d6d817622b0 Merge tag 'scsi-fixes' of git://git.kernel.or..
> >>> git tree:       upstream
> >>> console output: https://syzkaller.appspot.com/x/log.txt?x=15927479580000
> >>> kernel config:  https://syzkaller.appspot.com/x/.config?x=a59830cba91a1981
> >>> dashboard link: https://syzkaller.appspot.com/bug?extid=805630f1453e490427fa
> >>> compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> >>> 
> >>> Unfortunately, I don't have any reproducer for this issue yet.
> >>> 
> >>> Downloadable assets:
> >>> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-3d6d8176.raw.xz
> >>> vmlinux: https://storage.googleapis.com/syzbot-assets/d19e0514c02a/vmlinux-3d6d8176.xz
> >>> kernel image: https://storage.googleapis.com/syzbot-assets/f6da706811f4/bzImage-3d6d8176.xz
> >>> 
> >>> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> >>> Reported-by: [email protected]
> >>> 
> >>> gadgetfs: bound to dummy_udc driver
> >>> ------------[ cut here ]------------
> >>> 1
> >>> WARNING: mm/page_alloc.c:5280 at __alloc_frozen_pages_noprof+0x2ce/0x380 mm/page_alloc.c:5280, CPU#0: syz.0.0/5319
> >>
> >> Thanks.  drivers/usb/gadget is the offender.
> >>
> >> Gemini sums it up well.  "ep_write_iter() needs a bounds check prior to
> >> memory allocation".  https://share.gemini.google/5NzjyttO0ULc
> >>
> >> I expect an easy fix would be
> >>
> >> --- a/drivers/usb/gadget/legacy/inode.c~a
> >> +++ a/drivers/usb/gadget/legacy/inode.c
> >> @@ -666,7 +666,7 @@ ep_write_iter(struct kiocb *iocb, struct
> >>  		return -EBADMSG;
> >>  	}
> >>  
> >> -	buf = kmalloc(len, GFP_KERNEL);
> >> +	buf = kmalloc(len, GFP_KERNEL|__GFP_NOWARN);
> >>  	if (unlikely(!buf)) {
> >>  		mutex_unlock(&epdata->lock);
> >>  		return -ENOMEM;
> >>
> >> or do what Gemini said.  Me, I'll add some cc's and run away.
> >
> > Let’s do this instead of suppressing kmalloc WARNs. Since a similar WARN[1]
> > showed up yesterday and that WARN is better handled by a bound check,
> > I do not think we want to lose the WARN from kmalloc/the page allocator.
> >
> > [1] https://lore.kernel.org/all/[email protected]/

Fair enough.

> > Like the patch below:
> >
> > From 732ea7074854ac3495bbceb274cdd01966118e57 Mon Sep 17 00:00:00 2001
> > From: Zi Yan <[email protected]>
> > Date: Thu, 20 Aug 2026 09:19:12 -0400
> > Subject: [PATCH] USB: gadgetfs: do not WARN about excessively large memory
> >  allocations
> >
> > GadgetFS passes an excessively large user input len to kmalloc and kmalloc
> > gives a WARN (see below for details). Suppress it by passing __GFP_NOWARN
> > to kmalloc used by both ep_write_iter() and ep_read_iter(). Follow the same
> > method as commit 4f2629ea67e72 ("USB: usbfs: Don't WARN about excessively
> > large memory allocations").
> >
> > kmalloc is used to allocate physically contiguous memory for kernel
> > allocations. For requests larger than KMALLOC_MAX_CACHE_SIZE, kmalloc uses
> > the page allocator and can only support up to KMALLOC_MAX_SIZE. For request
> > sizes bigger than KMALLOC_MAX_SIZE, the page allocator can emit a WARN
> > because kmalloc allocates an order greater than MAX_PAGE_ORDER.
> >
> > Fixes: b3c466ce5129 ("page allocator: do not sanity check order in the fast path")
> > Reported-by: [email protected]
> > Closes: https://lore.kernel.org/all/[email protected]/
> > Tested-by: [email protected]
> > Signed-off-by: Zi Yan <[email protected]>
> > Cc: [email protected]
> > ---
> >  drivers/usb/gadget/legacy/inode.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
> > index d87a8ab515107..278a0a2b39f4c 100644
> > --- a/drivers/usb/gadget/legacy/inode.c
> > +++ b/drivers/usb/gadget/legacy/inode.c
> > @@ -604,7 +604,7 @@ ep_read_iter(struct kiocb *iocb, struct iov_iter *to)
> >  		return -EBADMSG;
> >  	}
> >  
> > -	buf = kmalloc(len, GFP_KERNEL);
> > +	buf = kmalloc(len, GFP_KERNEL | __GFP_NOWARN);
> >  	if (unlikely(!buf)) {
> >  		mutex_unlock(&epdata->lock);
> >  		return -ENOMEM;
> > @@ -666,7 +666,7 @@ ep_write_iter(struct kiocb *iocb, struct iov_iter *from)
> >  		return -EBADMSG;
> >  	}
> >  
> > -	buf = kmalloc(len, GFP_KERNEL);
> > +	buf = kmalloc(len, GFP_KERNEL | __GFP_NOWARN);
> >  	if (unlikely(!buf)) {
> >  		mutex_unlock(&epdata->lock);
> >  		return -ENOMEM;

Acked-by: Alan Stern <[email protected]>

Alan Stern