CVE-2022-50151

In the Linux kernel, the following vulnerability has been resolved:

usb: cdns3: fix random warning message when driver load

Warning log:

[ 4.141392] Unexpected gfp: 0x4 (GFP_DMA32). Fixing up to gfp: 0xa20 (GFP_ATOMIC). Fix your code!

[ 4.150340] CPU: 1 PID: 175 Comm: 1-0050 Not tainted 5.15.5-00039-g2fd9ae1b568c #20

[ 4.158010] Hardware name: Freescale i.MX8QXP MEK (DT)

[ 4.163155] Call trace:

[ 4.165600] dump_backtrace+0x0/0x1b0

[ 4.169286] show_stack+0x18/0x68

[ 4.172611] dump_stack_lvl+0x68/0x84

[ 4.176286] dump_stack+0x18/0x34

[ 4.179613] kmalloc_fix_flags+0x60/0x88

[ 4.183550] new_slab+0x334/0x370

[ 4.186878] ___slab_alloc.part.108+0x4d4/0x748

[ 4.191419] __slab_alloc.isra.109+0x30/0x78

[ 4.195702] kmem_cache_alloc+0x40c/0x420

[ 4.199725] dma_pool_alloc+0xac/0x1f8

[ 4.203486] cdns3_allocate_trb_pool+0xb4/0xd0

pool_alloc_page(struct dma_pool *pool, gfp_t mem_flags)

{

...

page = kmalloc(sizeof(*page), mem_flags);

page->vaddr = dma_alloc_coherent(pool->dev, pool->allocation,

&page->dma, mem_flags);

...

}

kmalloc was called with mem_flags, which is passed down in

cdns3_allocate_trb_pool() and have GFP_DMA32 flags.

kmall_fix_flags() report warning.

GFP_DMA32 is not useful at all. dma_alloc_coherent() will handle

DMA memory region correctly by pool->dev. GFP_DMA32 can be removed

safely.