On Wed, 2022-06-22 at 05:15 +0100, Al Viro wrote:
> Incidentally, ITER_XARRAY did *not* free the sucker in case when
> iter_xarray_populate_pages() returned 0...
>
> Signed-off-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx>
> ---
> lib/iov_iter.c | 38 ++++++++++++++++++++++----------------
> 1 file changed, 22 insertions(+), 16 deletions(-)
>
> diff --git a/lib/iov_iter.c b/lib/iov_iter.c
> index c3fb7853dbe8..9c25661684c6 100644
> --- a/lib/iov_iter.c
> +++ b/lib/iov_iter.c
> @@ -1425,15 +1425,10 @@ static ssize_t pipe_get_pages_alloc(struct iov_iter *i,
> maxsize = n;
> else
> npages = DIV_ROUND_UP(maxsize + off, PAGE_SIZE);
> - p = get_pages_array(npages);
> + *pages = p = get_pages_array(npages);
> if (!p)
> return -ENOMEM;
> - n = __pipe_get_pages(i, maxsize, p, off);
> - if (n > 0)
> - *pages = p;
> - else
> - kvfree(p);
> - return n;
> + return __pipe_get_pages(i, maxsize, p, off);
> }
>
> static ssize_t iter_xarray_get_pages_alloc(struct iov_iter *i,
> @@ -1463,10 +1458,9 @@ static ssize_t iter_xarray_get_pages_alloc(struct iov_iter *i,
> count++;
> }
>
> - p = get_pages_array(count);
> + *pages = p = get_pages_array(count);
> if (!p)
> return -ENOMEM;
> - *pages = p;
>
> nr = iter_xarray_populate_pages(p, i->xarray, index, count);
> if (nr == 0)
> @@ -1475,7 +1469,7 @@ static ssize_t iter_xarray_get_pages_alloc(struct iov_iter *i,
> return min_t(size_t, nr * PAGE_SIZE - offset, maxsize);
> }
>
> -ssize_t iov_iter_get_pages_alloc(struct iov_iter *i,
> +static ssize_t __iov_iter_get_pages_alloc(struct iov_iter *i,
> struct page ***pages, size_t maxsize,
> size_t *start)
> {
> @@ -1501,16 +1495,12 @@ ssize_t iov_iter_get_pages_alloc(struct iov_iter *i,
>
> addr = first_iovec_segment(i, &len, start, maxsize, ~0U);
> n = DIV_ROUND_UP(len, PAGE_SIZE);
> - p = get_pages_array(n);
> + *pages = p = get_pages_array(n);
> if (!p)
> return -ENOMEM;
> res = get_user_pages_fast(addr, n, gup_flags, p);
> - if (unlikely(res <= 0)) {
> - kvfree(p);
> - *pages = NULL;
> + if (unlikely(res <= 0))
> return res;
> - }
> - *pages = p;
> return (res == n ? len : res * PAGE_SIZE) - *start;
> }
> if (iov_iter_is_bvec(i)) {
> @@ -1531,6 +1521,22 @@ ssize_t iov_iter_get_pages_alloc(struct iov_iter *i,
> return iter_xarray_get_pages_alloc(i, pages, maxsize, start);
> return -EFAULT;
> }
> +
> +ssize_t iov_iter_get_pages_alloc(struct iov_iter *i,
> + struct page ***pages, size_t maxsize,
> + size_t *start)
> +{
> + ssize_t len;
> +
> + *pages = NULL;
> +
> + len = __iov_iter_get_pages_alloc(i, pages, maxsize, start);
> + if (len <= 0) {
> + kvfree(*pages);
> + *pages = NULL;
> + }
> + return len;
> +}
> EXPORT_SYMBOL(iov_iter_get_pages_alloc);
>
> size_t csum_and_copy_from_iter(void *addr, size_t bytes, __wsum *csum,
Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>
