On Wed, May 6, 2020 at 1:08 AM John Hubbard <jhubbard@xxxxxxxxxx> wrote:
>
> On 2020-05-05 12:14, Souptick Joarder wrote:
> > Currently {get|pin}_user_pages_fast() have 3 return value 0, -errno
> > and no of pinned pages. The only case where these two functions will
> > return 0, is for nr_pages <= 0, which doesn't find a valid use case.
> > But if at all any, then a -ERRNO will be returned instead of 0, which
> > means {get|pin}_user_pages_fast() will have 2 return values -errno &
> > no of pinned pages.
> >
> > Update all the callers which deals with return value 0 accordingly.
>
> Hmmm, seems a little shaky. In order to do this safely, I'd recommend
> first changing gup_fast/pup_fast so so that they return -EINVAL if
> the caller specified nr_pages==0, and of course auditing all callers,
> to ensure that this won't cause problems.
While auditing it was figured out, there are 5 callers which cares for
return value
0 of gup_fast/pup_fast. What problem it might cause if we change
gup_fast/pup_fast
to return -EINVAL and update all the callers in a single commit ?
>
> The gup.c documentation would also need updating in a couple of comment
> blocks, above get_user_pages_remote(), and __get_user_pages(), because
> those talk about a zero return value.
OK.
>
> This might be practical without slowing down the existing code, because
> there is already a check in place, so just tweaking it like this (untested)
> won't change performance at all:
>
> diff --git a/mm/gup.c b/mm/gup.c
> index 11fda538c9d9..708eed79ae29 100644
> --- a/mm/gup.c
> +++ b/mm/gup.c
> @@ -2787,7 +2787,7 @@ static int internal_get_user_pages_fast(unsigned long start,
> int nr_pages,
> end = start + len;
>
> if (end <= start)
> - return 0;
> + return -EINVAL;
> if (unlikely(!access_ok((void __user *)start, len)))
> return -EFAULT;
>
> ...although I might be missing some other things that need a similar change,
> so you should look carefully for yourself.
Do you refer to other gup APIs similar to gup_fast/pup_fast ?
>
>
> Once that change (and anything I missed) is in place, then you could go
> ahead and stop handling ret==0 cases at the call sites.
>
>
> thanks,
> --
> John Hubbard
> NVIDIA
>
> >
> > Signed-off-by: Souptick Joarder <jrdr.linux@xxxxxxxxx>
> > ---
> > arch/ia64/kernel/err_inject.c | 2 +-
> > drivers/platform/goldfish/goldfish_pipe.c | 2 +-
> > drivers/staging/gasket/gasket_page_table.c | 4 ++--
> > drivers/tee/tee_shm.c | 2 +-
> > mm/gup.c | 6 +++---
> > net/rds/rdma.c | 2 +-
> > 6 files changed, 9 insertions(+), 9 deletions(-)
> >
> > diff --git a/arch/ia64/kernel/err_inject.c b/arch/ia64/kernel/err_inject.c
> > index 8b5b8e6b..fd72218 100644
> > --- a/arch/ia64/kernel/err_inject.c
> > +++ b/arch/ia64/kernel/err_inject.c
> > @@ -143,7 +143,7 @@ static DEVICE_ATTR(name, 0644, show_##name, store_##name)
> > int ret;
> >
> > ret = get_user_pages_fast(virt_addr, 1, FOLL_WRITE, NULL);
> > - if (ret<=0) {
> > + if (ret < 0) {
> > #ifdef ERR_INJ_DEBUG
> > printk("Virtual address %lx is not existing.\n",virt_addr);
> > #endif
> > diff --git a/drivers/platform/goldfish/goldfish_pipe.c b/drivers/platform/goldfish/goldfish_pipe.c
> > index 1ab207e..831449d 100644
> > --- a/drivers/platform/goldfish/goldfish_pipe.c
> > +++ b/drivers/platform/goldfish/goldfish_pipe.c
> > @@ -277,7 +277,7 @@ static int goldfish_pin_pages(unsigned long first_page,
> > ret = pin_user_pages_fast(first_page, requested_pages,
> > !is_write ? FOLL_WRITE : 0,
> > pages);
> > - if (ret <= 0)
> > + if (ret < 0)
> > return -EFAULT;
> > if (ret < requested_pages)
> > *iter_last_page_size = PAGE_SIZE;
> > diff --git a/drivers/staging/gasket/gasket_page_table.c b/drivers/staging/gasket/gasket_page_table.c
> > index f6d7157..1d08e1d 100644
> > --- a/drivers/staging/gasket/gasket_page_table.c
> > +++ b/drivers/staging/gasket/gasket_page_table.c
> > @@ -489,11 +489,11 @@ static int gasket_perform_mapping(struct gasket_page_table *pg_tbl,
> > ret = get_user_pages_fast(page_addr - offset, 1,
> > FOLL_WRITE, &page);
> >
> > - if (ret <= 0) {
> > + if (ret < 0) {
> > dev_err(pg_tbl->device,
> > "get user pages failed for addr=0x%lx, offset=0x%lx [ret=%d]\n",
> > page_addr, offset, ret);
> > - return ret ? ret : -ENOMEM;
> > + return ret;
> > }
> > ++pg_tbl->num_active_pages;
> >
> > diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c
> > index bd679b7..2706a1f 100644
> > --- a/drivers/tee/tee_shm.c
> > +++ b/drivers/tee/tee_shm.c
> > @@ -230,7 +230,7 @@ struct tee_shm *tee_shm_register(struct tee_context *ctx, unsigned long addr,
> > if (rc > 0)
> > shm->num_pages = rc;
> > if (rc != num_pages) {
> > - if (rc >= 0)
> > + if (rc > 0)
> > rc = -ENOMEM;
> > ret = ERR_PTR(rc);
> > goto err;
> > diff --git a/mm/gup.c b/mm/gup.c
> > index 50681f0..8d293ed 100644
> > --- a/mm/gup.c
> > +++ b/mm/gup.c
> > @@ -2760,7 +2760,7 @@ static int internal_get_user_pages_fast(unsigned long start, int nr_pages,
> > end = start + len;
> >
> > if (end <= start)
> > - return 0;
> > + return -EINVAL;
> > if (unlikely(!access_ok((void __user *)start, len)))
> > return -EFAULT;
> >
> > @@ -2805,8 +2805,8 @@ static int internal_get_user_pages_fast(unsigned long start, int nr_pages,
> > * calling get_user_pages().
> > *
> > * Returns number of pages pinned. This may be fewer than the number requested.
> > - * If nr_pages is 0 or negative, returns 0. If no pages were pinned, returns
> > - * -errno.
> > + * If nr_pages is 0 or negative, returns -errno. If no pages were pinned,
> > + * returns -errno.
> > */
> > int get_user_pages_fast(unsigned long start, int nr_pages,
> > unsigned int gup_flags, struct page **pages)
> > diff --git a/net/rds/rdma.c b/net/rds/rdma.c
> > index a7ae118..44b96e6 100644
> > --- a/net/rds/rdma.c
> > +++ b/net/rds/rdma.c
> > @@ -161,7 +161,7 @@ static int rds_pin_pages(unsigned long user_addr, unsigned int nr_pages,
> > gup_flags |= FOLL_WRITE;
> >
> > ret = pin_user_pages_fast(user_addr, nr_pages, gup_flags, pages);
> > - if (ret >= 0 && ret < nr_pages) {
> > + if (ret > 0 && ret < nr_pages) {
> > unpin_user_pages(pages, ret);
> > ret = -EFAULT;
> > }
> >
>
_______________________________________________
devel mailing list
devel@xxxxxxxxxxxxxxxxxxxxxx
http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
