* [PATCH net] macvtap: fix recovery from gup errors
@ 2013-06-23 14:26 Michael S. Tsirkin
2013-06-24 3:23 ` Jason Wang
0 siblings, 1 reply; 3+ messages in thread
From: Michael S. Tsirkin @ 2013-06-23 14:26 UTC (permalink / raw)
To: linux-kernel
Cc: David S. Miller, Jason Wang, Eric Dumazet, Andrew Morton, netdev,
Brad Hubbard
get user pages might fail partially in macvtap zero copy
mode. To recover we need to put all pages that we got,
but code used a wrong index resulting in double-free
errors.
Reported-by: Brad Hubbard <bhubbard@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
Same as the tun patch really. Also stable material.
drivers/net/macvtap.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 59e9605..4ddd108 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -524,8 +524,9 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
return -EMSGSIZE;
num_pages = get_user_pages_fast(base, size, 0, &page[i]);
if (num_pages != size) {
- for (i = 0; i < num_pages; i++)
- put_page(page[i]);
+ int j;
+ for (j = 0; j < num_pages; j++)
+ put_page(page[i + j]);
return -EFAULT;
}
truesize = size * PAGE_SIZE;
--
MST
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] macvtap: fix recovery from gup errors
2013-06-23 14:26 [PATCH net] macvtap: fix recovery from gup errors Michael S. Tsirkin
@ 2013-06-24 3:23 ` Jason Wang
2013-06-25 23:24 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Jason Wang @ 2013-06-24 3:23 UTC (permalink / raw)
To: Michael S. Tsirkin
Cc: linux-kernel, David S. Miller, Eric Dumazet, Andrew Morton,
netdev, Brad Hubbard
On 06/23/2013 10:26 PM, Michael S. Tsirkin wrote:
> get user pages might fail partially in macvtap zero copy
> mode. To recover we need to put all pages that we got,
> but code used a wrong index resulting in double-free
> errors.
>
> Reported-by: Brad Hubbard <bhubbard@redhat.com>
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
> ---
>
> Same as the tun patch really. Also stable material.
Acked-by: Jason Wang <jasowang@redhat.com>
>
> drivers/net/macvtap.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
> index 59e9605..4ddd108 100644
> --- a/drivers/net/macvtap.c
> +++ b/drivers/net/macvtap.c
> @@ -524,8 +524,9 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,
> return -EMSGSIZE;
> num_pages = get_user_pages_fast(base, size, 0, &page[i]);
> if (num_pages != size) {
> - for (i = 0; i < num_pages; i++)
> - put_page(page[i]);
> + int j;
> + for (j = 0; j < num_pages; j++)
> + put_page(page[i + j]);
> return -EFAULT;
> }
> truesize = size * PAGE_SIZE;
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] macvtap: fix recovery from gup errors
2013-06-24 3:23 ` Jason Wang
@ 2013-06-25 23:24 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2013-06-25 23:24 UTC (permalink / raw)
To: jasowang; +Cc: mst, linux-kernel, edumazet, akpm, netdev, bhubbard
From: Jason Wang <jasowang@redhat.com>
Date: Mon, 24 Jun 2013 11:23:15 +0800
> On 06/23/2013 10:26 PM, Michael S. Tsirkin wrote:
>> get user pages might fail partially in macvtap zero copy
>> mode. To recover we need to put all pages that we got,
>> but code used a wrong index resulting in double-free
>> errors.
>>
>> Reported-by: Brad Hubbard <bhubbard@redhat.com>
>> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
>> ---
>>
>> Same as the tun patch really. Also stable material.
>
> Acked-by: Jason Wang <jasowang@redhat.com>
Applied, also with the missing empty line added.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-06-25 23:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-06-23 14:26 [PATCH net] macvtap: fix recovery from gup errors Michael S. Tsirkin
2013-06-24 3:23 ` Jason Wang
2013-06-25 23:24 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).