Gui-Dong Han
85f6a6590d
usb: mon: Fix atomicity violation in mon_bin_vma_fault ...
commit 2dd23cc4d0e6aa55cf9fb3b05f2f4165b01de81c upstream.
In mon_bin_vma_fault():
offset = vmf->pgoff << PAGE_SHIFT;
if (offset >= rp->b_size)
return VM_FAULT_SIGBUS;
chunk_idx = offset / CHUNK_SIZE;
pageptr = rp->b_vec[chunk_idx].pg;
The code is executed without holding any lock.
In mon_bin_vma_close():
spin_lock_irqsave(&rp->b_lock, flags);
rp->mmap_active--;
spin_unlock_irqrestore(&rp->b_lock, flags);
In mon_bin_ioctl():
spin_lock_irqsave(&rp->b_lock, flags);
if (rp->mmap_active) {
...
} else {
...
kfree(rp->b_vec);
rp->b_vec = vec;
rp->b_size = size;
...
}
spin_unlock_irqrestore(&rp->b_lock, flags);
Concurrent execution of mon_bin_vma_fault() with mon_bin_vma_close() and
mon_bin_ioctl() could lead to atomicity violations. mon_bin_vma_fault()
accesses rp->b_size and rp->b_vec without locking, risking array
out-of-bounds access or use-after-free bugs due to possible modifications
in mon_bin_ioctl().
This possible bug is found by an experimental static analysis tool
developed by our team, BassCheck[1]. This tool analyzes the locking APIs
to extract function pairs that can be concurrently executed, and then
analyzes the instructions in the paired functions to identify possible
concurrency bugs including data races and atomicity violations. The above
possible bug is reported when our tool analyzes the source code of
Linux 6.2.
To address this issue, it is proposed to add a spin lock pair in
mon_bin_vma_fault() to ensure atomicity. With this patch applied, our tool
never reports the possible bug, with the kernel configuration allyesconfig
for x86_64. Due to the lack of associated hardware, we cannot test the
patch in runtime testing, and just verify it according to the code logic.
[1] https://sites.google.com/view/basscheck/
Fixes: 19e6317d24c2 ("usb: mon: Fix a deadlock in usbmon between ...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Gui-Dong Han <2045gemini@gmail.com>
Link: https://lore.kernel.org/r/20240105052412.9377-1-2045gemini@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2024-01-25 14:34:30 -08:00
ACPI: LPIT: Avoid u32 multiplication overflow
2024-01-25 14:34:22 -08:00
amba: bus: fix refcount leak
2023-09-23 10:59:52 +02:00
binder: fix unused alloc->free_async_space
2024-01-25 14:34:29 -08:00
ata: pata_isapnp: Add missing error check for devm_ioport_map()
2023-12-08 08:44:23 +01:00
atm: solos-pci: Fix potential deadlock on &tx_queue_lock
2023-12-20 15:41:15 +01:00
devcoredump: Send uevent once devcd is ready
2023-12-13 18:18:18 +01:00
remove the sx8 block driver
2023-11-08 11:23:42 +01:00
Bluetooth: btmtkuart: fix recv_buf() return value
2024-01-25 14:34:26 -08:00
bus: ti-sysc: Fix SYSC_QUIRK_SWSUP_SIDLE_ACT handling for uart wake-up
2023-10-10 21:46:39 +02:00
hwrng: geode - fix accessing registers
2023-11-20 10:30:12 +01:00
clk: si5341: fix an error code problem in si5341_output_clk_set_rate
2024-01-25 14:34:28 -08:00
clocksource/drivers/timer-atmel-tcb: Fix initialization on SAM9 hardware
2023-11-28 16:50:13 +00:00
cpufreq: imx6q: Don't disable 792 Mhz OPP unnecessarily
2023-12-08 08:44:28 +01:00
crypto: sahara - do not resize req->src when doing hash operations
2024-01-25 14:34:24 -08:00
PM / devfreq: Fix leak in devfreq_dev_release()
2023-09-23 10:59:54 +02:00
dmaengine: stm32-mdma: correct desc prep when channel running
2023-11-28 16:50:19 +00:00
dma-buf/sw_sync: Avoid recursive lock during fence signal
2023-08-30 16:27:28 +02:00
EDAC/thunderx: Fix possible out-of-bounds string access
2024-01-25 14:34:21 -08:00
extcon: Fix kernel doc of property capability fields to avoid warnings
2023-07-27 08:37:20 +02:00
firewire: ohci: suppress unexpected system reboot in AMD Ryzen machines and ASM108x/VT630x PCIe cards
2024-01-15 18:25:27 +01:00
firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
2024-01-25 14:34:25 -08:00
fsi: master-ast-cf: Add MODULE_FIRMWARE macro
2023-09-23 10:59:37 +02:00
gpiolib: sysfs: Fix error handling on failed export
2023-12-13 18:18:15 +01:00
gpu/drm/radeon: fix two memleaks in radeon_vm_init
2024-01-25 14:34:28 -08:00
HID: hid-asus: add const to read-only outgoing usb buffer
2023-12-20 15:41:23 +01:00
Drivers: hv: vmbus: Fix vmbus_wait_for_unload() to scan present CPUs
2023-06-28 10:18:36 +02:00
hwmon: (acpi_power_meter) Fix 4.29 MW bug
2023-12-13 18:18:13 +01:00
coresight: etm4x: Fix width of CCITMIN field
2024-01-25 14:34:21 -08:00
i2c: core: Fix atomic xfer check for non-preempt config
2024-01-15 18:25:27 +01:00
i3c: master: cdns: Fix reading status register
2023-11-28 16:50:19 +00:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
2024-01-08 11:29:46 +01:00
RDMA/usnic: Silence uninitialized symbol smatch warnings
2024-01-25 14:34:26 -08:00
Input: atkbd - use ab83 as id when skipping the getid command
2024-01-25 14:34:29 -08:00
interconnect: Treat xlate() returning NULL node as an error
2024-01-08 11:29:45 +01:00
of/iommu: Make of_map_rid() PCI agnostic
2023-12-13 18:18:11 +01:00
firmware: ti_sci: Replace HTTP links with HTTPS ones
2023-11-20 10:30:12 +01:00
mISDN: Update parameter type of dsp_cmx_send()
2023-08-16 18:19:23 +02:00
leds: trigger: ledtrig-cpu:: Fix 'output may be truncated' issue for 'cpu'
2023-11-20 10:30:13 +01:00
mailbox: ti-msgmgr: Fill non-message tx data fields with 0x0
2023-07-27 08:37:23 +02:00
mcb: fix error handling for different scenarios when parsing
2023-11-28 16:50:19 +00:00
bcache: avoid NULL checking to c->root in run_cache_set()
2023-12-20 15:41:20 +01:00
media: dvbdev: drop refcount on error path in dvb_device_open()
2024-01-25 14:34:28 -08:00
memory: brcmstb_dpfe: fix testing array offset after use
2023-07-27 08:37:14 +02:00
memstick r592: make memstick_debug_get_tpc_name() static
2023-07-27 08:37:10 +02:00
mfd: dln2: Fix double put in dln2_probe
2023-11-20 10:30:13 +01:00
misc: st_core: Do not call kfree_skb() under spin_lock_irqsave()
2023-11-20 10:30:13 +01:00
mmc: sdhci_omap: Fix TI SoC dependencies
2024-01-25 14:34:28 -08:00
mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
2024-01-25 14:34:23 -08:00
xen-netback: don't produce zero-size SKB frags
2024-01-25 14:34:29 -08:00
nfcsim.c: Fix error checking for debugfs_create_dir
2023-06-28 10:18:41 +02:00
ntb: Fix calculation ntb_transport_tx_free_entry()
2023-09-23 10:59:55 +02:00
nd_btt: Make BTT lanes preemptible
2023-11-20 10:30:12 +01:00
nvme: introduce helper function to get ctrl state
2024-01-25 14:34:19 -08:00
nvmem: imx: correct nregs for i.MX6UL
2023-11-08 11:23:37 +01:00
of: unittest: Fix of_count_phandle_with_args() expected value message
2024-01-25 14:34:29 -08:00
OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd()
2023-09-23 10:59:40 +02:00
parisc: iosapic.c: Fix sparse warnings
2023-10-10 21:46:39 +02:00
parport: parport_serial: Add Brainboxes device IDs and geometry
2024-01-25 14:34:21 -08:00
PCI: Disable ATS for specific Intel IPU E2000 devices
2024-01-15 18:25:29 +01:00
pcmcia: ds: fix possible name leak in error path in pcmcia_device_add()
2023-11-20 10:30:14 +01:00
perf/smmuv3: Enable HiSilicon Erratum 162001900 quirk for HIP08/09
2023-09-23 11:00:03 +02:00
phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins
2023-10-25 11:53:25 +02:00
pinctrl: lochnagar: Don't build on MIPS
2024-01-25 14:34:19 -08:00
platform/x86: intel_telemetry: Fix kernel doc descriptions
2023-12-20 15:41:21 +01:00
power: supply: Fix logic checking if system is running from battery
2023-06-21 15:44:09 +02:00
powercap: RAPL: Fix CONFIG_IOSF_MBI dependency
2023-07-27 08:37:06 +02:00
ptp: annotate data-race around q->head and q->tail
2023-11-28 16:50:16 +00:00
pwm: brcmstb: Utilize appropriate clock APIs in suspend/resume
2023-11-20 10:30:15 +01:00
regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()"
2023-10-25 11:53:23 +02:00
reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
2024-01-25 14:34:20 -08:00
rpmsg: Fix possible refcount leak in rpmsg_register_device_override()
2023-11-08 11:23:40 +01:00
rtc: pcf85363: fix wrong mask/val parameters in regmap_update_bits call
2023-11-20 10:30:14 +01:00
s390/scm: fix virtual vs physical address confusion
2024-01-25 14:34:20 -08:00
scsi: hisi_sas: Replace with standard error code return value
2024-01-25 14:34:25 -08:00
soc: qcom: llcc: Handle a second device without data corruption
2023-11-20 10:30:12 +01:00
soundwire: stream: fix NULL pointer dereference for multi_link
2023-12-20 15:41:24 +01:00
spi: sh-msiof: Enforce fixed DTDL for R-Car H3
2024-01-25 14:34:23 -08:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
staging: rtl8712: fix race condition
2023-09-23 10:59:37 +02:00
scsi: target: core: Fix deadlock due to recursive locking
2023-10-10 21:46:43 +02:00
thermal: core: prevent potential string overflow
2023-11-20 10:30:09 +01:00
serial: 8250_omap: Add earlycon support for the AM654 UART controller
2023-12-13 18:18:16 +01:00
uio: Fix use-after-free in uio_open
2024-01-25 14:34:21 -08:00
usb: mon: Fix atomicity violation in mon_bin_vma_fault
2024-01-25 14:34:30 -08:00
treewide: Remove uninitialized_var() usage
2023-06-09 10:29:01 +02:00
fbdev: stifb: Make the STI next font pointer a 32-bit signed offset
2023-12-08 08:44:27 +01:00
virtio-mmio: fix memory leak of vm_dev
2023-11-08 11:23:34 +01:00
w1: fix loop in w1_fini()
2023-07-27 08:37:19 +02:00
watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
2024-01-25 14:34:28 -08:00
xen/events: fix delayed eoi list handling
2023-11-28 16:50:16 +00:00
85f6a6590d