From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1760596Ab3GZVVk (ORCPT ); Fri, 26 Jul 2013 17:21:40 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:51018 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932839Ab3GZUxj (ORCPT ); Fri, 26 Jul 2013 16:53:39 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brad Hubbard , "Michael S. Tsirkin" , Jason Wang , "David S. Miller" Subject: [ 21/59] macvtap: fix recovery from gup errors Date: Fri, 26 Jul 2013 13:52:45 -0700 Message-Id: <20130726205016.092120142@linuxfoundation.org> X-Mailer: git-send-email 1.8.3.rc0.20.gb99dd2e In-Reply-To: <20130726205013.795696531@linuxfoundation.org> References: <20130726205013.795696531@linuxfoundation.org> User-Agent: quilt/0.60-5.1.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: "Michael S. Tsirkin" [ Upstream commit 4c7ab054ab4f5d63625508ed6f8a607184cae7c2 ] get user pages might fail partially in macvtap zero copy mode. To recover we need to put all pages that we got, but code used a wrong index resulting in double-free errors. Reported-by: Brad Hubbard Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/macvtap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/net/macvtap.c +++ b/drivers/net/macvtap.c @@ -534,8 +534,10 @@ static int zerocopy_sg_from_iovec(struct return -EMSGSIZE; num_pages = get_user_pages_fast(base, size, 0, &page[i]); if (num_pages != size) { - for (i = 0; i < num_pages; i++) - put_page(page[i]); + int j; + + for (j = 0; j < num_pages; j++) + put_page(page[i + j]); } truesize = size * PAGE_SIZE; skb->data_len += len;