From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brad Hubbard , "Michael S. Tsirkin" , Jason Wang , "David S. Miller" Subject: [ 21/59] macvtap: fix recovery from gup errors Date: Fri, 26 Jul 2013 13:52:45 -0700 Message-Id: <20130726205016.092120142@linuxfoundation.org> In-Reply-To: <20130726205013.795696531@linuxfoundation.org> References: <20130726205013.795696531@linuxfoundation.org> Sender: linux-kernel-owner@vger.kernel.org List-ID: 3.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: "Michael S. Tsirkin" [ Upstream commit 4c7ab054ab4f5d63625508ed6f8a607184cae7c2 ] get user pages might fail partially in macvtap zero copy mode. To recover we need to put all pages that we got, but code used a wrong index resulting in double-free errors. Reported-by: Brad Hubbard Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/macvtap.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/net/macvtap.c +++ b/drivers/net/macvtap.c @@ -534,8 +534,10 @@ static int zerocopy_sg_from_iovec(struct return -EMSGSIZE; num_pages = get_user_pages_fast(base, size, 0, &page[i]); if (num_pages != size) { - for (i = 0; i < num_pages; i++) - put_page(page[i]); + int j; + + for (j = 0; j < num_pages; j++) + put_page(page[i + j]); } truesize = size * PAGE_SIZE; skb->data_len += len;