mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-25 10:19:47 +00:00
USB: fix usbmon BUG trigger
Automated tests triggered this by opening usbmon and accessing the mmap while simultaneously resizing the buffers. This bug was with us since 2006, because typically applications only size the buffers once and thus avoid racing. Reported by Kirill A. Shutemov. Reported-by: <syzbot+f9831b881b3e849829fc@syzkaller.appspotmail.com> Signed-off-by: Pete Zaitcev <zaitcev@redhat.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
5fd77a3a0e
commit
46eb14a6e1
1 changed files with 7 additions and 1 deletions
|
@ -1004,7 +1004,9 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg
|
|||
break;
|
||||
|
||||
case MON_IOCQ_RING_SIZE:
|
||||
mutex_lock(&rp->fetch_lock);
|
||||
ret = rp->b_size;
|
||||
mutex_unlock(&rp->fetch_lock);
|
||||
break;
|
||||
|
||||
case MON_IOCT_RING_SIZE:
|
||||
|
@ -1231,12 +1233,16 @@ static int mon_bin_vma_fault(struct vm_fault *vmf)
|
|||
unsigned long offset, chunk_idx;
|
||||
struct page *pageptr;
|
||||
|
||||
mutex_lock(&rp->fetch_lock);
|
||||
offset = vmf->pgoff << PAGE_SHIFT;
|
||||
if (offset >= rp->b_size)
|
||||
if (offset >= rp->b_size) {
|
||||
mutex_unlock(&rp->fetch_lock);
|
||||
return VM_FAULT_SIGBUS;
|
||||
}
|
||||
chunk_idx = offset / CHUNK_SIZE;
|
||||
pageptr = rp->b_vec[chunk_idx].pg;
|
||||
get_page(pageptr);
|
||||
mutex_unlock(&rp->fetch_lock);
|
||||
vmf->page = pageptr;
|
||||
return 0;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue