From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Message-ID: <547DBEC2.5010505@mev.co.uk> Date: Tue, 02 Dec 2014 13:29:38 +0000 From: Ian Abbott MIME-Version: 1.0 To: haver@linux.vnet.ibm.com CC: Arnd Bergmann , Greg Kroah-Hartman , linux-kernel@vger.kernel.org, stable@vger.kernel.org, Thadeu Lima De Souza Cascardo Subject: Re: [PATCH] misc: genwqe: check for error from get_user_pages_fast() References: <1415291019-6178-1-git-send-email-abbotti@mev.co.uk> <1417525160.2010.4.camel@oc7383187364.ibm.com> In-Reply-To: <1417525160.2010.4.camel@oc7383187364.ibm.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: On 02/12/14 12:59, Frank Haverkamp wrote: > Hi Ian, > > thanks for reviewing our code and sorry for not answering immediately. > > Am Donnerstag, den 06.11.2014, 16:23 +0000 schrieb Ian Abbott: >> `genwqe_user_vmap()` calls `get_user_pages_fast()` and if the return >> value is less than the number of pages requested, it frees the pages and >> returns an error (`-EFAULT`). However, it fails to consider a negative >> error return value from `get_user_pages_fast()`. In that case, the test >> `if (rc < m->nr_pages)` will be false (due to promotion of `rc` to a >> large `unsigned int`) and the code will continue on to call >> `genwqe_map_pages()` with an invalid list of page pointers. Fix it by >> bailing out if `get_user_pages_fast()` returns a negative error value. > > True. Did you find this by manual inspection of the code or did you use > tools to figure it out? I just spotted it while grepping for examples of drivers that used get_user_pages() or get_user_pages_fast() as I want to use it in a driver for some custom hardware. -- -=( Ian Abbott @ MEV Ltd. E-mail: )=- -=( Web: http://www.mev.co.uk/ )=-