Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0edffa0b authored by Pete Zaitcev's avatar Pete Zaitcev Committed by Greg Kroah-Hartman
Browse files

USB: fix usbmon BUG trigger 



commit 46eb14a6e1585d99c1b9f58d0e7389082a5f466b upstream.

Automated tests triggered this by opening usbmon and accessing the
mmap while simultaneously resizing the buffers. This bug was with
us since 2006, because typically applications only size the buffers
once and thus avoid racing. Reported by Kirill A. Shutemov.

Reported-by: default avatar <syzbot+f9831b881b3e849829fc@syzkaller.appspotmail.com>
Signed-off-by: default avatarPete Zaitcev <zaitcev@redhat.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a52b2f87

drivers/usb/mon/mon_bin.c

+7 −1
Original line number Diff line number Diff line
@@ -1000,7 +1000,9 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg 
		break;



	case MON_IOCQ_RING_SIZE:

		mutex_lock(&rp->fetch_lock);

		ret = rp->b_size;

		mutex_unlock(&rp->fetch_lock);

		break;



	case MON_IOCT_RING_SIZE:
@@ -1227,12 +1229,16 @@ static int mon_bin_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf) 
	unsigned long offset, chunk_idx;

	struct page *pageptr;



	mutex_lock(&rp->fetch_lock);

	offset = vmf->pgoff << PAGE_SHIFT;

	if (offset >= rp->b_size)

	if (offset >= rp->b_size) {

		mutex_unlock(&rp->fetch_lock);

		return VM_FAULT_SIGBUS;

	}

	chunk_idx = offset / CHUNK_SIZE;

	pageptr = rp->b_vec[chunk_idx].pg;

	get_page(pageptr);

	mutex_unlock(&rp->fetch_lock);

	vmf->page = pageptr;

	return 0;

}