From: Andrew Morton <akpm@linux-foundation.org>
To: akpm@linux-foundation.org, alex.bou9@gmail.com,
dan.carpenter@oracle.com, jhubbard@nvidia.com,
linux-mm@kvack.org, mm-commits@vger.kernel.org,
mporter@kernel.crashing.org, stable@vger.kernel.org,
sumit.semwal@linaro.org, torvalds@linux-foundation.org
Subject: [patch 03/11] rapidio: fix an error in get_user_pages_fast() error handling
Date: Fri, 22 May 2020 22:22:48 -0700 [thread overview]
Message-ID: <20200523052248.tWpCIO_Wo%akpm@linux-foundation.org> (raw)
In-Reply-To: <20200522222217.ee14ad7eda7aab1e6697da6c@linux-foundation.org>
From: John Hubbard <jhubbard@nvidia.com>
Subject: rapidio: fix an error in get_user_pages_fast() error handling
In the case of get_user_pages_fast() returning fewer pages than requested,
rio_dma_transfer() does not quite do the right thing. It attempts to
release all the pages that were requested, rather than just the pages that
were pinned.
Fix the error handling so that only the pages that were successfully
pinned are released.
Link: http://lkml.kernel.org/r/20200517235620.205225-2-jhubbard@nvidia.com
Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Matt Porter <mporter@kernel.crashing.org>
Cc: Alexandre Bounine <alex.bou9@gmail.com>
Cc: Sumit Semwal <sumit.semwal@linaro.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
drivers/rapidio/devices/rio_mport_cdev.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/rapidio/devices/rio_mport_cdev.c~rapidio-fix-an-error-in-get_user_pages_fast-error-handling
+++ a/drivers/rapidio/devices/rio_mport_cdev.c
@@ -877,6 +877,11 @@ rio_dma_transfer(struct file *filp, u32
rmcd_error("pinned %ld out of %ld pages",
pinned, nr_pages);
ret = -EFAULT;
+ /*
+ * Set nr_pages up to mean "how many pages to unpin, in
+ * the error handler:
+ */
+ nr_pages = pinned;
goto err_pg;
}
_
next prev parent reply other threads:[~2020-05-23 5:22 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200522222217.ee14ad7eda7aab1e6697da6c@linux-foundation.org>
2020-05-23 5:22 ` [patch 01/11] device-dax: don't leak kernel memory to user space after unloading kmem Andrew Morton
2020-05-23 5:22 ` Andrew Morton [this message]
2020-05-23 5:22 ` [patch 06/11] kasan: disable branch tracing for core runtime Andrew Morton
2020-05-23 5:23 ` [patch 07/11] sh: include linux/time_types.h for sockios Andrew Morton
2020-05-23 5:23 ` [patch 09/11] sparc32: use PUD rather than PGD to get PMD in srmmu_nocache_init() Andrew Morton
2020-05-23 19:01 ` Mike Rapoport
2020-05-23 19:10 ` Linus Torvalds
2020-05-23 19:57 ` Mike Rapoport
2020-05-23 5:23 ` [patch 10/11] z3fold: fix use-after-free when freeing handles Andrew Morton
2020-05-25 0:08 ` + mmthp-stop-leaking-unreleased-file-pages.patch added to -mm tree Andrew Morton
2020-05-25 0:49 ` + mm-remove-vm_bug_onpageslab-from-page_mapcount.patch " Andrew Morton
2020-05-28 0:10 ` + relay-handle-alloc_percpu-returning-null-in-relay_open.patch " Andrew Morton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200523052248.tWpCIO_Wo%akpm@linux-foundation.org \
--to=akpm@linux-foundation.org \
--cc=alex.bou9@gmail.com \
--cc=dan.carpenter@oracle.com \
--cc=jhubbard@nvidia.com \
--cc=linux-mm@kvack.org \
--cc=mm-commits@vger.kernel.org \
--cc=mporter@kernel.crashing.org \
--cc=stable@vger.kernel.org \
--cc=sumit.semwal@linaro.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).