kmalloc is used to allocate physically contiguous memory for kernel allocations. For requests larger than KMALLOC_MAX_CACHE_SIZE, kmalloc uses the page allocator and can only support up to KMALLOC_MAX_SIZE. For request sizes bigger than KMALLOC_MAX_SIZE, the page allocator can emit a WARN because kmalloc allocates an order greater than MAX_PAGE_ORDER. Systems with panic_on_warn=1 crash because of this WARN. Fix it by rejecting any kmalloc size bigger than KMALLOC_MAX_SIZE. Fixes: aadb4bc4a1f9 ("SLUB: direct pass through of page size or higher kmalloc requests") Reported-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6a820ebc.9ebadd4d.20b15e.001b.GAE@google.com/ Tested-by: syzbot+805630f1453e490427fa@syzkaller.appspotmail.com Signed-off-by: Zi Yan Cc: stable@vger.kernel.org --- It fixes a page allocator warning (order > MAX_PAGE_ORDER) when gadgetfs requests excessively large memory from kmalloc. Instead of adding __GFP_NOWARN to suppress the warning, as was done for usbfs[1], change kmalloc to return NULL without a warning for this specific issue. [1] commit 4f2629ea67e72 ("USB: usbfs: Don't WARN about excessively large memory allocations") --- mm/slub.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/mm/slub.c b/mm/slub.c index 0337e60db5ace..a3071f4ef1945 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -5263,7 +5263,12 @@ static void *___kmalloc_large_node(size_t size, gfp_t flags, int node) { struct page *page; void *ptr = NULL; - unsigned int order = get_order(size); + unsigned int order; + + if (size > KMALLOC_MAX_SIZE) + return NULL; + + order = get_order(size); if (unlikely(flags & GFP_SLAB_BUG_MASK)) flags = kmalloc_fix_flags(flags); --- base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f change-id: 20260817-limit_kmalloc_size-3a4a2c73beac Best regards, -- Yan, Zi