From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A606C4708B for ; Mon, 15 Nov 2021 19:40:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 38A4461AFB for ; Mon, 15 Nov 2021 19:40:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343703AbhKOTh4 (ORCPT ); Mon, 15 Nov 2021 14:37:56 -0500 Received: from mail.kernel.org ([198.145.29.99]:40038 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239234AbhKOR4B (ORCPT ); Mon, 15 Nov 2021 12:56:01 -0500 Received: by mail.kernel.org (Postfix) with ESMTPSA id AB5C4632BF; Mon, 15 Nov 2021 17:33:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1636997621; bh=5D0OSs6CAyAiMAb6TI2VFOF170zKsZNjeWLJdRobvGg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jW5xXB0qGeoD8xCaazdq6LtQclFlPM7VvB+hUvYYyiT/05aH56qULX7z/QV1sQiru EkrOLKNFCwukFsR8a6p1sVS54JBu1aNlUB7sRcIxULVP/zCVS24AoO7wzJX+C/M/q8 0S+1VGPy+4cssFKj2OcOzbG12QXm/ymmsk/q4osg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andreas Gruenbacher , Christoph Hellwig , Sasha Levin Subject: [PATCH 5.10 213/575] iov_iter: Fix iov_iter_get_pages{,_alloc} page fault return value Date: Mon, 15 Nov 2021 17:58:58 +0100 Message-Id: <20211115165351.088826075@linuxfoundation.org> X-Mailer: git-send-email 2.33.1 In-Reply-To: <20211115165343.579890274@linuxfoundation.org> References: <20211115165343.579890274@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Andreas Gruenbacher [ Upstream commit 814a66741b9ffb5e1ba119e368b178edb0b7322d ] Both iov_iter_get_pages and iov_iter_get_pages_alloc return the number of bytes of the iovec they could get the pages for. When they cannot get any pages, they're supposed to return 0, but when the start of the iovec isn't page aligned, the calculation goes wrong and they return a negative value. Fix both functions. In addition, change iov_iter_get_pages_alloc to return NULL in that case to prevent resource leaks. Signed-off-by: Andreas Gruenbacher Reviewed-by: Christoph Hellwig Signed-off-by: Sasha Levin --- lib/iov_iter.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/lib/iov_iter.c b/lib/iov_iter.c index 537bfdc8cd095..b364231b5fc8c 100644 --- a/lib/iov_iter.c +++ b/lib/iov_iter.c @@ -1343,7 +1343,7 @@ ssize_t iov_iter_get_pages(struct iov_iter *i, res = get_user_pages_fast(addr, n, iov_iter_rw(i) != WRITE ? FOLL_WRITE : 0, pages); - if (unlikely(res < 0)) + if (unlikely(res <= 0)) return res; return (res == n ? len : res * PAGE_SIZE) - *start; 0;}),({ @@ -1424,8 +1424,9 @@ ssize_t iov_iter_get_pages_alloc(struct iov_iter *i, return -ENOMEM; res = get_user_pages_fast(addr, n, iov_iter_rw(i) != WRITE ? FOLL_WRITE : 0, p); - if (unlikely(res < 0)) { + if (unlikely(res <= 0)) { kvfree(p); + *pages = NULL; return res; } *pages = p; -- 2.33.0