Patch "VMCI: check return value of get_user_pages_fast() for errors" has been added to the 5.9-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    VMCI: check return value of get_user_pages_fast() for errors

to the 5.9-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     vmci-check-return-value-of-get_user_pages_fast-for-e.patch
and it can be found in the queue-5.9 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 649263e0dc1d43ecf0f5cd5eed58ef703e4eb4ee
Author: Alex Dewar <alex.dewar90@xxxxxxxxx>
Date:   Tue Aug 25 17:45:18 2020 +0100

    VMCI: check return value of get_user_pages_fast() for errors
    
    [ Upstream commit 90ca6333fd65f318c47bff425e1ea36c0a5539f6 ]
    
    In a couple of places in qp_host_get_user_memory(),
    get_user_pages_fast() is called without properly checking for errors. If
    e.g. -EFAULT is returned, this negative value will then be passed on to
    qp_release_pages(), which expects a u64 as input.
    
    Fix this by only calling qp_release_pages() when we have a positive
    number returned.
    
    Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
    Signed-off-by: Alex Dewar <alex.dewar90@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20200825164522.412392-1-alex.dewar90@xxxxxxxxx
    Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index 8531ae7811956..c49065887e8f5 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -657,8 +657,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
 	if (retval < (int)produce_q->kernel_if->num_pages) {
 		pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
 			retval);
-		qp_release_pages(produce_q->kernel_if->u.h.header_page,
-				 retval, false);
+		if (retval > 0)
+			qp_release_pages(produce_q->kernel_if->u.h.header_page,
+					retval, false);
 		err = VMCI_ERROR_NO_MEM;
 		goto out;
 	}
@@ -670,8 +671,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
 	if (retval < (int)consume_q->kernel_if->num_pages) {
 		pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
 			retval);
-		qp_release_pages(consume_q->kernel_if->u.h.header_page,
-				 retval, false);
+		if (retval > 0)
+			qp_release_pages(consume_q->kernel_if->u.h.header_page,
+					retval, false);
 		qp_release_pages(produce_q->kernel_if->u.h.header_page,
 				 produce_q->kernel_if->num_pages, false);
 		err = VMCI_ERROR_NO_MEM;



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux