From mboxrd@z Thu Jan 1 00:00:00 1970 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: base64 Subject: The usbmon triggers a BUG in ./include/linux/mm.h From: Pete Zaitcev Message-Id: <20180108154641.106218e8@lembas.zaitcev.lan> Date: Mon, 8 Jan 2018 15:46:41 -0600 To: "Kirill A. Shutemov" Cc: Andrew Morton , Greg Kroah-Hartman , linux-mm@kvack.org, linux-usb@vger.kernel.org, zaitcev@redhat.com List-ID: QXV0b21hdGVkIHRlc3RzIHRyaWdnZXJlZCB0aGlzIGJ5IG9wZW5pbmcgdXNibW9uIGFuZCBhY2Nl c3NpbmcgdGhlCm1tYXAgd2hpbGUgc2ltdWx0YW5lb3VzbHkgcmVzaXppbmcgdGhlIGJ1ZmZlcnMu IFRoaXMgYnVnIHdhcyB3aXRoCnVzIHNpbmNlIDIwMDYsIGJlY2F1c2UgdHlwaWNhbGx5IGFwcGxp Y2F0aW9ucyBvbmx5IHNpemUgdGhlIGJ1ZmZlcnMKb25jZSBhbmQgdGh1cyBhdm9pZCByYWNpbmcu IFJlcG9ydGVkIGJ5IEtpcmlsbCBBLiBTaHV0ZW1vdi4KClNpZ25lZC1vZmYtYnk6IFBldGUgWmFp dGNldiA8emFpdGNldkByZWRoYXQuY29tPgotLS0KIGRyaXZlcnMvdXNiL21vbi9tb25fYmluLmMg fCA4ICsrKysrKystCiAxIGZpbGUgY2hhbmdlZCwgNyBpbnNlcnRpb25zKCspLCAxIGRlbGV0aW9u KC0pCgpkaWZmIC0tZ2l0IGEvZHJpdmVycy91c2IvbW9uL21vbl9iaW4uYyBiL2RyaXZlcnMvdXNi L21vbi9tb25fYmluLmMKaW5kZXggZjZhZTc1M2FiOTliLi5mOTMyZjQwMzAyZGYgMTAwNjQ0Ci0t LSBhL2RyaXZlcnMvdXNiL21vbi9tb25fYmluLmMKKysrIGIvZHJpdmVycy91c2IvbW9uL21vbl9i aW4uYwpAQCAtMTAwNCw3ICsxMDA0LDkgQEAgc3RhdGljIGxvbmcgbW9uX2Jpbl9pb2N0bChzdHJ1 Y3QgZmlsZSAqZmlsZSwgdW5zaWduZWQgaW50IGNtZCwgdW5zaWduZWQgbG9uZyBhcmcKIAkJYnJl YWs7CiAKIAljYXNlIE1PTl9JT0NRX1JJTkdfU0laRToKKwkJbXV0ZXhfbG9jaygmcnAtPmZldGNo X2xvY2spOwogCQlyZXQgPSBycC0+Yl9zaXplOworCQltdXRleF91bmxvY2soJnJwLT5mZXRjaF9s b2NrKTsKIAkJYnJlYWs7CiAKIAljYXNlIE1PTl9JT0NUX1JJTkdfU0laRToKQEAgLTEyMzEsMTIg KzEyMzMsMTYgQEAgc3RhdGljIGludCBtb25fYmluX3ZtYV9mYXVsdChzdHJ1Y3Qgdm1fZmF1bHQg KnZtZikKIAl1bnNpZ25lZCBsb25nIG9mZnNldCwgY2h1bmtfaWR4OwogCXN0cnVjdCBwYWdlICpw YWdlcHRyOwogCisJbXV0ZXhfbG9jaygmcnAtPmZldGNoX2xvY2spOwogCW9mZnNldCA9IHZtZi0+ cGdvZmYgPDwgUEFHRV9TSElGVDsKLQlpZiAob2Zmc2V0ID49IHJwLT5iX3NpemUpCisJaWYgKG9m ZnNldCA+PSBycC0+Yl9zaXplKSB7CisJCW11dGV4X3VubG9jaygmcnAtPmZldGNoX2xvY2spOwog CQlyZXR1cm4gVk1fRkFVTFRfU0lHQlVTOworCX0KIAljaHVua19pZHggPSBvZmZzZXQgLyBDSFVO S19TSVpFOwogCXBhZ2VwdHIgPSBycC0+Yl92ZWNbY2h1bmtfaWR4XS5wZzsKIAlnZXRfcGFnZShw YWdlcHRyKTsKKwltdXRleF91bmxvY2soJnJwLT5mZXRjaF9sb2NrKTsKIAl2bWYtPnBhZ2UgPSBw YWdlcHRyOwogCXJldHVybiAwOwogfQo= From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-oi0-f72.google.com (mail-oi0-f72.google.com [209.85.218.72]) by kanga.kvack.org (Postfix) with ESMTP id 077D36B0069 for ; Mon, 8 Jan 2018 16:46:44 -0500 (EST) Received: by mail-oi0-f72.google.com with SMTP id 184so6843136oii.1 for ; Mon, 08 Jan 2018 13:46:44 -0800 (PST) Received: from mx1.redhat.com (mx1.redhat.com. [209.132.183.28]) by mx.google.com with ESMTPS id w197si3331492oie.8.2018.01.08.13.46.42 for (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 08 Jan 2018 13:46:43 -0800 (PST) Date: Mon, 8 Jan 2018 15:46:41 -0600 From: Pete Zaitcev Subject: [PATCH] The usbmon triggers a BUG in ./include/linux/mm.h Message-ID: <20180108154641.106218e8@lembas.zaitcev.lan> In-Reply-To: <20180103092604.5y4bvh3i644ts3zm@node.shutemov.name> References: <20171228160346.6406d52df0d9afe8cf7a0862@linux-foundation.org> <20171229132420.jn2pwabl6pyjo6mk@node.shutemov.name> <20180103010238.1e510ac2@lembas.zaitcev.lan> <20180103092604.5y4bvh3i644ts3zm@node.shutemov.name> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Sender: owner-linux-mm@kvack.org List-ID: To: "Kirill A. Shutemov" Cc: Andrew Morton , Greg Kroah-Hartman , linux-mm@kvack.org, linux-usb@vger.kernel.org, zaitcev@redhat.com Automated tests triggered this by opening usbmon and accessing the mmap while simultaneously resizing the buffers. This bug was with us since 2006, because typically applications only size the buffers once and thus avoid racing. Reported by Kirill A. Shutemov. Signed-off-by: Pete Zaitcev --- drivers/usb/mon/mon_bin.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c index f6ae753ab99b..f932f40302df 100644 --- a/drivers/usb/mon/mon_bin.c +++ b/drivers/usb/mon/mon_bin.c @@ -1004,7 +1004,9 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg break; case MON_IOCQ_RING_SIZE: + mutex_lock(&rp->fetch_lock); ret = rp->b_size; + mutex_unlock(&rp->fetch_lock); break; case MON_IOCT_RING_SIZE: @@ -1231,12 +1233,16 @@ static int mon_bin_vma_fault(struct vm_fault *vmf) unsigned long offset, chunk_idx; struct page *pageptr; + mutex_lock(&rp->fetch_lock); offset = vmf->pgoff << PAGE_SHIFT; - if (offset >= rp->b_size) + if (offset >= rp->b_size) { + mutex_unlock(&rp->fetch_lock); return VM_FAULT_SIGBUS; + } chunk_idx = offset / CHUNK_SIZE; pageptr = rp->b_vec[chunk_idx].pg; get_page(pageptr); + mutex_unlock(&rp->fetch_lock); vmf->page = pageptr; return 0; } -- 2.14.2 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: email@kvack.org