On Sun, Sep 13, 2020 at 8:25 PM Matthew Wilcox <willy@xxxxxxxxxxxxx> wrote: > > On Sun, Sep 13, 2020 at 08:02:35PM +0530, Souptick Joarder wrote: > > It is possible that a buggy caller of unpin_user_pages() > > (specially in error handling path) may end up calling it with > > npages < 0 which is unnecessary. > > @@ -328,6 +328,9 @@ void unpin_user_pages(struct page **pages, unsigned long npages) > > { > > unsigned long index; > > > > + if (WARN_ON_ONCE(npages < 0)) > > + return; > > But npages is unsigned long. So it can't be less than zero. Sorry, I missed it. Then, it means if npages is assigned with -ERRNO by caller, unpin_user_pages() may end up calling a big loop, which is unnecessary.