lkml.org 
[lkml]   [2020]   [Oct]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.9 217/757] VMCI: check return value of get_user_pages_fast() for errors
    Date
    From: Alex Dewar <alex.dewar90@gmail.com>

    [ Upstream commit 90ca6333fd65f318c47bff425e1ea36c0a5539f6 ]

    In a couple of places in qp_host_get_user_memory(),
    get_user_pages_fast() is called without properly checking for errors. If
    e.g. -EFAULT is returned, this negative value will then be passed on to
    qp_release_pages(), which expects a u64 as input.

    Fix this by only calling qp_release_pages() when we have a positive
    number returned.

    Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
    Signed-off-by: Alex Dewar <alex.dewar90@gmail.com>
    Link: https://lore.kernel.org/r/20200825164522.412392-1-alex.dewar90@gmail.com
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 ++++++----
    1 file changed, 6 insertions(+), 4 deletions(-)

    diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
    index 8531ae7811956..c49065887e8f5 100644
    --- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
    +++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
    @@ -657,8 +657,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
    if (retval < (int)produce_q->kernel_if->num_pages) {
    pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
    retval);
    - qp_release_pages(produce_q->kernel_if->u.h.header_page,
    - retval, false);
    + if (retval > 0)
    + qp_release_pages(produce_q->kernel_if->u.h.header_page,
    + retval, false);
    err = VMCI_ERROR_NO_MEM;
    goto out;
    }
    @@ -670,8 +671,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
    if (retval < (int)consume_q->kernel_if->num_pages) {
    pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
    retval);
    - qp_release_pages(consume_q->kernel_if->u.h.header_page,
    - retval, false);
    + if (retval > 0)
    + qp_release_pages(consume_q->kernel_if->u.h.header_page,
    + retval, false);
    qp_release_pages(produce_q->kernel_if->u.h.header_page,
    produce_q->kernel_if->num_pages, false);
    err = VMCI_ERROR_NO_MEM;
    --
    2.25.1


    \
     
     \ /
      Last update: 2020-10-27 16:35    [W:4.532 / U:0.040 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site