Patch "media: atomisp: Fixed error handling path" has been added to the 5.10-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    media: atomisp: Fixed error handling path

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     media-atomisp-fixed-error-handling-path.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit f433002db29e1cf8d25123e0e6f9c4a7ee6f9545
Author: Souptick Joarder <jrdr.linux@xxxxxxxxx>
Date:   Sun Sep 27 17:08:04 2020 +0200

    media: atomisp: Fixed error handling path
    
    [ Upstream commit 16a5dcf7fbc2f5cd10c1e6264262bfa3832fb7d5 ]
    
    Inside alloc_user_pages() based on flag value either pin_user_pages()
    or get_user_pages_fast() will be called. However, these API might fail.
    
    But free_user_pages() called in error handling path doesn't bother
    about return value and will try to unpin bo->pgnr pages, which is
    incorrect.
    
    Fix this by passing the page_nr to free_user_pages(). If page_nr > 0
    pages will be unpinned based on bo->mem_type. This will also take care
    of non error handling path.
    
    allocation")
    
    Link: https://lore.kernel.org/linux-media/1601219284-13275-1-git-send-email-jrdr.linux@xxxxxxxxx
    Fixes: 14a638ab96c5 ("media: atomisp: use pin_user_pages() for memory
    Signed-off-by: Souptick Joarder <jrdr.linux@xxxxxxxxx>
    Cc: John Hubbard <jhubbard@xxxxxxxxxx>
    Cc: Ira Weiny <ira.weiny@xxxxxxxxx>
    Reviewed-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
    Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/staging/media/atomisp/pci/hmm/hmm_bo.c b/drivers/staging/media/atomisp/pci/hmm/hmm_bo.c
index f13af2329f48..0168f9839c90 100644
--- a/drivers/staging/media/atomisp/pci/hmm/hmm_bo.c
+++ b/drivers/staging/media/atomisp/pci/hmm/hmm_bo.c
@@ -857,16 +857,17 @@ static void free_private_pages(struct hmm_buffer_object *bo,
 	kfree(bo->page_obj);
 }
 
-static void free_user_pages(struct hmm_buffer_object *bo)
+static void free_user_pages(struct hmm_buffer_object *bo,
+			    unsigned int page_nr)
 {
 	int i;
 
 	hmm_mem_stat.usr_size -= bo->pgnr;
 
 	if (bo->mem_type == HMM_BO_MEM_TYPE_PFN) {
-		unpin_user_pages(bo->pages, bo->pgnr);
+		unpin_user_pages(bo->pages, page_nr);
 	} else {
-		for (i = 0; i < bo->pgnr; i++)
+		for (i = 0; i < page_nr; i++)
 			put_page(bo->pages[i]);
 	}
 	kfree(bo->pages);
@@ -942,6 +943,8 @@ static int alloc_user_pages(struct hmm_buffer_object *bo,
 		dev_err(atomisp_dev,
 			"get_user_pages err: bo->pgnr = %d, pgnr actually pinned = %d.\n",
 			bo->pgnr, page_nr);
+		if (page_nr < 0)
+			page_nr = 0;
 		goto out_of_mem;
 	}
 
@@ -954,7 +957,7 @@ static int alloc_user_pages(struct hmm_buffer_object *bo,
 
 out_of_mem:
 
-	free_user_pages(bo);
+	free_user_pages(bo, page_nr);
 
 	return -ENOMEM;
 }
@@ -1037,7 +1040,7 @@ void hmm_bo_free_pages(struct hmm_buffer_object *bo)
 	if (bo->type == HMM_BO_PRIVATE)
 		free_private_pages(bo, &dynamic_pool, &reserved_pool);
 	else if (bo->type == HMM_BO_USER)
-		free_user_pages(bo);
+		free_user_pages(bo, bo->pgnr);
 	else
 		dev_err(atomisp_dev, "invalid buffer type.\n");
 	mutex_unlock(&bo->mutex);