linux-kernel - Re: [PATCH] mm/gup.c: Handle error at earliest for incorrect nr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 30 Apr 2020 14:24:12 -0700
From:   Ira Weiny <ira.weiny@...el.com>
To:     Souptick Joarder <jrdr.linux@...il.com>
Cc:     akpm@...ux-foundation.org, linux-mm@...ck.org,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mm/gup.c: Handle error at earliest for incorrect
 nr_pages value

On Fri, May 01, 2020 at 01:41:58AM +0530, Souptick Joarder wrote:
> As per documentation, pin_user_pages_fast() & get_user_pages_fast()
> will return 0, if nr_pages <= 0. But this can be figure out only after
> going inside the internal_get_user_pages_fast().

Why is nr_pages not unsigned?  I seem to have convinced myself before that
there was a good reason for it but really what is the point of calling either
of these functions with nr_pages not > 0?

> 
> This can be handled early. Adding a check for the same.
> 
> Signed-off-by: Souptick Joarder <jrdr.linux@...il.com>
> ---
>  mm/gup.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/mm/gup.c b/mm/gup.c
> index 50681f0..a13aaa6 100644
> --- a/mm/gup.c
> +++ b/mm/gup.c
> @@ -2817,6 +2817,8 @@ int get_user_pages_fast(unsigned long start, int nr_pages,
>  	 */
>  	if (WARN_ON_ONCE(gup_flags & FOLL_PIN))
>  		return -EINVAL;
> +	if (nr_pages <= 0)
> +		return 0;

I think the documentation may be wrong here...  Is there a caller who expects a
return of 0 for this behavior?

It seems like these should be a warn on and return -EINVAL.  I just don't see
the use case here.

Ira

>  
>  	/*
>  	 * The caller may or may not have explicitly set FOLL_GET; either way is
> @@ -2854,6 +2856,8 @@ int pin_user_pages_fast(unsigned long start, int nr_pages,
>  	/* FOLL_GET and FOLL_PIN are mutually exclusive. */
>  	if (WARN_ON_ONCE(gup_flags & FOLL_GET))
>  		return -EINVAL;
> +	if (nr_pages <= 0)
> +		return 0;
>  
>  	gup_flags |= FOLL_PIN;
>  	return internal_get_user_pages_fast(start, nr_pages, gup_flags, pages);
> -- 
> 1.9.1
> 
>