The usbmon triggers a BUG in ./include/linux/mm.h

The usbmon triggers a BUG in ./include/linux/mm.h

[Pete Zaitcev]

Automated tests triggered this by opening usbmon and accessing the
mmap while simultaneously resizing the buffers. This bug was with
us since 2006, because typically applications only size the buffers
once and thus avoid racing. Reported by Kirill A. Shutemov.

Signed-off-by: Pete Zaitcev <zaitcev@redhat.com>
---
 drivers/usb/mon/mon_bin.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index f6ae753ab99b..f932f40302df 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -1004,7 +1004,9 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg
 		break;
 
 	case MON_IOCQ_RING_SIZE:
+		mutex_lock(&rp->fetch_lock);
 		ret = rp->b_size;
+		mutex_unlock(&rp->fetch_lock);
 		break;
 
 	case MON_IOCT_RING_SIZE:
@@ -1231,12 +1233,16 @@ static int mon_bin_vma_fault(struct vm_fault *vmf)
 	unsigned long offset, chunk_idx;
 	struct page *pageptr;
 
+	mutex_lock(&rp->fetch_lock);
 	offset = vmf->pgoff << PAGE_SHIFT;
-	if (offset >= rp->b_size)
+	if (offset >= rp->b_size) {
+		mutex_unlock(&rp->fetch_lock);
 		return VM_FAULT_SIGBUS;
+	}
 	chunk_idx = offset / CHUNK_SIZE;
 	pageptr = rp->b_vec[chunk_idx].pg;
 	get_page(pageptr);
+	mutex_unlock(&rp->fetch_lock);
 	vmf->page = pageptr;
 	return 0;
 }

The usbmon triggers a BUG in ./include/linux/mm.h

[Greg Kroah-Hartman]

On Mon, Jan 08, 2018 at 03:46:41PM -0600, Pete Zaitcev wrote:
> Automated tests triggered this by opening usbmon and accessing the
> mmap while simultaneously resizing the buffers. This bug was with
> us since 2006, because typically applications only size the buffers
> once and thus avoid racing. Reported by Kirill A. Shutemov.
> 
> Signed-off-by: Pete Zaitcev <zaitcev@redhat.com>
> ---
>  drivers/usb/mon/mon_bin.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)

You forgot a reported-by line :(

I'll go add it, it's been a while since you submitted a kernel patch,
you must have forgotten :)

thanks,

greg k-h
---
To unsubscribe from this list: send the line "unsubscribe linux-usb" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html