__get_user_pages_locked() may return the number of pages less than
nr_pages. So __gup_longterm_locked() have to return the number of
pages __get_user_pages_locked() returns if it succeeded, not nr_pages
requested.
Fixes: 61c63c2076d9 (mm/gup.c: simplify and fix check_and_migrate_movable_pages() return codes)
CC: Alistair Popple <apopple@xxxxxxxxxx>
Reported-by: syzbot+616ff0452fec30f4dcfd@xxxxxxxxxxxxxxxxxxxxxxxxx
Reviewed-by: John Hubbard <jhubbard@xxxxxxxxxx>
Signed-off-by: Shigeru Yoshida <syoshida@xxxxxxxxxx>
---
mm/gup.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/mm/gup.c b/mm/gup.c
index 5aa7531a703b..66582203220a 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -2068,22 +2068,24 @@ static long __gup_longterm_locked(struct mm_struct *mm,
unsigned int gup_flags)
{
unsigned int flags;
- long rc;
+ long rc, nr_pinned_pages;
if (!(gup_flags & FOLL_LONGTERM))
return __get_user_pages_locked(mm, start, nr_pages, pages, vmas,
NULL, gup_flags);
flags = memalloc_pin_save();
do {
- rc = __get_user_pages_locked(mm, start, nr_pages, pages, vmas,
- NULL, gup_flags);
- if (rc <= 0)
+ nr_pinned_pages =
+ __get_user_pages_locked(mm, start, nr_pages, pages,
+ vmas, NULL, gup_flags);
+ if (nr_pinned_pages <= 0)
break;
- rc = check_and_migrate_movable_pages(rc, pages, gup_flags);
+ rc = check_and_migrate_movable_pages(nr_pinned_pages, pages,
+ gup_flags);
} while (rc == -EAGAIN);
memalloc_pin_restore(flags);
- return rc ? rc : nr_pages;
+ return rc ? rc : nr_pinned_pages;
}
static bool is_valid_gup_flags(unsigned int gup_flags)
--
2.37.2
