kernel/linux.git/drivers/usb/mon/mon_bin.c, branch linux-4.4.y

usb: mon: Fix a deadlock in usbmon between mmap and read

2019-12-21T09:35:17+00:00

commit 19e6317d24c25ee737c65d1ffb7483bdda4bb54a upstream. The problem arises because our read() function grabs a lock of the circular buffer, finds something of interest, then invokes copy_to_user() straight from the buffer, which in turn takes mm->mmap_sem. In the same time, the callback mon_bin_vma_fault() is invoked under mm->mmap_sem. It attempts to take the fetch lock and deadlocks. This patch does away with protecting of our page list with any semaphores, and instead relies on the kernel not close the device while mmap is active in a process. In addition, we prohibit re-sizing of a buffer while mmap is active. This way, when (now unlocked) fault is processed, it works with the page that is intended to be mapped-in, and not some other random page. Note that this may have an ABI impact, but hopefully no legitimate program is this wrong. Signed-off-by: Pete Zaitcev Reported-by: syzbot+56f9673bb4cdcbeb0e92@syzkaller.appspotmail.com Reviewed-by: Alan Stern Fixes: 46eb14a6e158 ("USB: fix usbmon BUG trigger") Cc: Link: https://lore.kernel.org/r/20191204203941.3503452b@suzdal.zaitcev.lan Signed-off-by: Greg Kroah-Hartman

USB: fix usbmon BUG trigger

2018-01-17T08:35:31+00:00

commit 46eb14a6e1585d99c1b9f58d0e7389082a5f466b upstream. Automated tests triggered this by opening usbmon and accessing the mmap while simultaneously resizing the buffers. This bug was with us since 2006, because typically applications only size the buffers once and thus avoid racing. Reported by Kirill A. Shutemov. Reported-by: Signed-off-by: Pete Zaitcev Signed-off-by: Greg Kroah-Hartman

USB: mon_bin.c: move assignment out of if () block

2015-05-10T14:01:11+00:00

We should not be doing assignments within an if () block so fix up the code to not do this. change was created using Coccinelle. Signed-off-by: Greg Kroah-Hartman Reviewed-by: Felipe Balbi

mm: kill vma flag VM_RESERVED and mm->reserved_vm counter

2012-10-09T07:22:19+00:00

A long time ago, in v2.4, VM_RESERVED kept swapout process off VMA, currently it lost original meaning but still has some effects: | effect | alternative flags -+------------------------+--------------------------------------------- 1| account as reserved_vm | VM_IO 2| skip in core dump | VM_IO, VM_DONTDUMP 3| do not merge or expand | VM_IO, VM_DONTEXPAND, VM_HUGETLB, VM_PFNMAP 4| do not mlock | VM_IO, VM_DONTEXPAND, VM_HUGETLB, VM_PFNMAP This patch removes reserved_vm counter from mm_struct. Seems like nobody cares about it, it does not exported into userspace directly, it only reduces total_vm showed in proc. Thus VM_RESERVED can be replaced with VM_IO or pair VM_DONTEXPAND | VM_DONTDUMP. remap_pfn_range() and io_remap_pfn_range() set VM_IO|VM_DONTEXPAND|VM_DONTDUMP. remap_vmalloc_range() set VM_DONTEXPAND | VM_DONTDUMP. [akpm@linux-foundation.org: drivers/vfio/pci/vfio_pci.c fixup] Signed-off-by: Konstantin Khlebnikov Cc: Alexander Viro Cc: Carsten Otte Cc: Chris Metcalf Cc: Cyrill Gorcunov Cc: Eric Paris Cc: H. Peter Anvin Cc: Hugh Dickins Cc: Ingo Molnar Cc: James Morris Cc: Jason Baron Cc: Kentaro Takeda Cc: Matt Helsley Cc: Nick Piggin Cc: Oleg Nesterov Cc: Peter Zijlstra Cc: Robert Richter Cc: Suresh Siddha Cc: Tetsuo Handa Cc: Venkatesh Pallipadi Acked-by: Linus Torvalds Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds

usb: Add export.h for EXPORT_SYMBOL/THIS_MODULE where needed

2011-10-31T23:31:25+00:00

With module.h being implicitly everywhere via device.h, the absence of explicitly including something for EXPORT_SYMBOL went unnoticed. Since we are heading to fix things up and clean module.h from the device.h file, we need to explicitly include these files now. Use the lightweight version of the header that has just THIS_MODULE and EXPORT_SYMBOL variants. Signed-off-by: Paul Gortmaker

usbmon vs. tcpdump: fix dropped packet count

2011-09-26T22:36:07+00:00

Report the number of dropped packets instead of zero when using the binary usbmon interface with tcpdump. # tcpdump -i usbmon1 -w dump tcpdump: listening on usbmon1, link-type USB_LINUX_MMAPPED (USB with padded Linux header), capture size 65535 bytes ^C2155 packets captured 2155 packets received by filter 1019 packets dropped by kernel Signed-off-by: Johannes Stezenbach Cc: stable Signed-off-by: Greg Kroah-Hartman

Merge branch 'usb-next' into musb-merge

2010-12-16T18:05:06+00:00

* usb-next: (132 commits) USB: uas: Use GFP_NOIO instead of GFP_KERNEL in I/O submission path USB: uas: Ensure we only bind to a UAS interface USB: uas: Rename sense pipe and sense urb to status pipe and status urb USB: uas: Use kzalloc instead of kmalloc USB: uas: Fix up the Sense IU usb: musb: core: kill unneeded #include's DA8xx: assign name to MUSB IRQ resource usb: gadget: g_ncm added usb: gadget: f_ncm.c added usb: gadget: u_ether: prepare for NCM usb: pch_udc: Fix setup transfers with data out usb: pch_udc: Fix compile error, warnings and checkpatch warnings usb: add ab8500 usb transceiver driver USB: gadget: Implement runtime PM for MSM bus glue driver USB: gadget: Implement runtime PM for ci13xxx gadget USB: gadget: Add USB controller driver for MSM SoC USB: gadget: Introduce ci13xxx_udc_driver struct USB: gadget: Initialize ci13xxx gadget device's coherent DMA mask USB: gadget: Fix "scheduling while atomic" bugs in ci13xxx_udc USB: gadget: Separate out PCI bus code from ci13xxx_udc ...

usbmon: correct length for isochronous

2010-12-01T00:44:54+00:00

Usually the usbmon returns the amount of data specified in urb->transfer_buffer_length for output submissions and urb->actual_length for input callbacks. However, for Isochronous input transfers, this is not enough, since the returned data buffer may contain "holes". One easy way to fix this is to use urb->transfer_buffer_length, but this often transfers a whole lot of unused data, so we find how much was actually used instead. Original patch by Márton Németh. See also kernel bug 22182. Signed-off-by: Pete Zaitcev Signed-off-by: Márton Németh Signed-off-by: Greg Kroah-Hartman

BKL: remove extraneous #include

2010-11-17T16:59:32+00:00

The big kernel lock has been removed from all these files at some point, leaving only the #include. Remove this too as a cleanup. Signed-off-by: Arnd Bergmann Signed-off-by: Linus Torvalds

USB: resizing usbmon binary interface buffer causes protection faults

2010-08-10T21:35:41+00:00

Enlarging the buffer size via the MON_IOCT_RING_SIZE ioctl causes general protection faults. It appears the culprit is an incorrect argument to mon_free_buff: instead of passing the size of the current buffer being freed, the size of the new buffer is passed. Use the correct size argument to mon_free_buff when changing the size of the buffer. Signed-off-by: Steven Robertson Acked-by: Pete Zaitcev Cc: stable Signed-off-by: Greg Kroah-Hartman