linux-stable.git/drivers/usb/mon, branch linux-4.9.y

usb: mon: make mmapped memory read only

2022-10-26T11:15:34+00:00

commit a659daf63d16aa883be42f3f34ff84235c302198 upstream.

Syzbot found an issue in usbmon module, where the user space client can
corrupt the monitor's internal memory, causing the usbmon module to
crash the kernel with segfault, UAF, etc.

The reproducer mmaps the /dev/usbmon memory to user space, and
overwrites it with arbitrary data, which causes all kinds of issues.

Return an -EPERM error from mon_bin_mmap() if the flag VM_WRTIE is set.
Also clear VM_MAYWRITE to make it impossible to change it to writable
later.

Cc: "Dmitry Vyukov" 
Cc: stable 
Fixes: 6f23ee1fefdc ("USB: add binary API to usbmon")
Suggested-by: PaX Team 	# for the VM_MAYRITE portion
Link: https://syzkaller.appspot.com/bug?id=2eb1f35d6525fa4a74d75b4244971e5b1411c95a
Reported-by: syzbot+23f57c5ae902429285d7@syzkaller.appspotmail.com
Signed-off-by: Tadeusz Struk 
Link: https://lore.kernel.org/r/20220919215957.205681-1-tadeusz.struk@linaro.org
Signed-off-by: Greg Kroah-Hartman

usb: mon: Fix a deadlock in usbmon between mmap and read

2019-12-21T09:41:56+00:00

commit 19e6317d24c25ee737c65d1ffb7483bdda4bb54a upstream.

The problem arises because our read() function grabs a lock of the
circular buffer, finds something of interest, then invokes copy_to_user()
straight from the buffer, which in turn takes mm->mmap_sem. In the same
time, the callback mon_bin_vma_fault() is invoked under mm->mmap_sem.
It attempts to take the fetch lock and deadlocks.

This patch does away with protecting of our page list with any
semaphores, and instead relies on the kernel not close the device
while mmap is active in a process.

In addition, we prohibit re-sizing of a buffer while mmap is active.
This way, when (now unlocked) fault is processed, it works with the
page that is intended to be mapped-in, and not some other random page.
Note that this may have an ABI impact, but hopefully no legitimate
program is this wrong.

Signed-off-by: Pete Zaitcev 
Reported-by: syzbot+56f9673bb4cdcbeb0e92@syzkaller.appspotmail.com
Reviewed-by: Alan Stern 
Fixes: 46eb14a6e158 ("USB: fix usbmon BUG trigger")
Cc: 
Link: https://lore.kernel.org/r/20191204203941.3503452b@suzdal.zaitcev.lan
Signed-off-by: Greg Kroah-Hartman

usb: usbmon: Read text within supplied buffer size

2018-03-18T10:18:56+00:00

commit a5f596830e27e15f7a0ecd6be55e433d776986d8 upstream.

This change fixes buffer overflows and silent data corruption with the
usbmon device driver text file read operations.

Signed-off-by: Fredrik Noring 
Signed-off-by: Pete Zaitcev 
Cc: stable 
Signed-off-by: Greg Kroah-Hartman

USB: fix usbmon BUG trigger

2018-01-17T08:38:55+00:00

commit 46eb14a6e1585d99c1b9f58d0e7389082a5f466b upstream.

Automated tests triggered this by opening usbmon and accessing the
mmap while simultaneously resizing the buffers. This bug was with
us since 2006, because typically applications only size the buffers
once and thus avoid racing. Reported by Kirill A. Shutemov.

Reported-by: 
Signed-off-by: Pete Zaitcev 
Signed-off-by: Greg Kroah-Hartman

usb: core: rename mutex usb_bus_list_lock to usb_bus_idr_lock

2016-02-07T05:55:57+00:00

Now that usb_bus_list has been removed and switched to idr
rename the related mutex accordingly.

Signed-off-by: Heiner Kallweit 
Signed-off-by: Greg Kroah-Hartman

usb: core: switch bus numbering to using idr

2016-02-03T21:26:30+00:00

USB bus numbering is based on directly dealing with bitmaps and
defines a separate list of busses.
This can be simplified and unified by using existing idr functionality.

Signed-off-by: Heiner Kallweit 
Signed-off-by: Greg Kroah-Hartman

USB: usbmon: remove assignment from IS_ERR argument

2016-01-04T00:55:59+00:00

The semantic patch that makes this change is as follows:
(http://coccinelle.lip6.fr/)

// 
@@
expression e1,e2;
statement S1,S2;
@@

+e1 = e2;
if (IS_ERR(
    e1
-   = e2
   )) S1 else S2
// 

Signed-off-by: Julia Lawall 
Signed-off-by: Greg Kroah-Hartman

USB: usbmon: Use 64bit timestamp for mon_bin_hdr

2015-12-01T22:54:06+00:00

struct mon_bin_hdr allows for a 64-bit seconds timestamp. The code
currently uses 'struct timeval' to populate the timestamp in mon_bin_hdr,
which has a 32-bit seconds field and will overflow in year 2038 and beyond.
This patch replaces 'struct timeval' with 'struct timespec64' which is
y2038 safe. This patch is part of a larger attempt to remove instances
of struct timeval and other 32-bit timekeeping (time_t, struct timespec)
from the kernel.

Signed-off-by: Tina Ruchandani 
Reviewed-by: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman

USB: usbmon: Remove timeval usage for timestamp

2015-12-01T22:48:26+00:00

struct timeval' uses 32-bits for its seconds field and will overflow in
the year 2038 and beyond. This patch replaces the usage of 'struct timeval'
in mon_get_timestamp() with timespec64 which uses a 64-bit seconds field
and is y2038-safe. mon_get_timestamp() truncates the timestamp at 4096 seconds,
so the correctness of the code is not affected. This patch is part of a larger
attempt to remove instances of struct timeval and other 32-bit timekeeping
(time_t, struct timespec) from the kernel.

Signed-off-by: Tina Ruchandani 
Suggested-by: Arnd Bergmann 
Reviewed-by: Arnd Bergmann 
Signed-off-by: Greg Kroah-Hartman

USB: constify usb_mon_operations structure

2015-12-01T22:36:29+00:00

The usb_mon_operations structure is never modified, so declare it as const.

Done with the help of Coccinelle.

Signed-off-by: Julia Lawall 
Signed-off-by: Greg Kroah-Hartman