linux-kernel - Re: [PATCH] mm/gup.c: Handle error at earliest for incorrect nr

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFqt6zZ0w+i-Chc7_MCvjbMjWmC78+T+E+5RwGF=pc7ouMnHBA@mail.gmail.com>
Date:   Sat, 2 May 2020 02:46:59 +0530
From:   Souptick Joarder <jrdr.linux@...il.com>
To:     Ira Weiny <ira.weiny@...el.com>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Linux-MM <linux-mm@...ck.org>, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] mm/gup.c: Handle error at earliest for incorrect nr_pages value

On Fri, May 1, 2020 at 2:54 AM Ira Weiny <ira.weiny@...el.com> wrote:
>
> On Fri, May 01, 2020 at 01:41:58AM +0530, Souptick Joarder wrote:
> > As per documentation, pin_user_pages_fast() & get_user_pages_fast()
> > will return 0, if nr_pages <= 0. But this can be figure out only after
> > going inside the internal_get_user_pages_fast().
>
> Why is nr_pages not unsigned?

Not sure of why but it can be unsigned.

>
> >
> > This can be handled early. Adding a check for the same.
> >
> > Signed-off-by: Souptick Joarder <jrdr.linux@...il.com>
> > ---
> >  mm/gup.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/mm/gup.c b/mm/gup.c
> > index 50681f0..a13aaa6 100644
> > --- a/mm/gup.c
> > +++ b/mm/gup.c
> > @@ -2817,6 +2817,8 @@ int get_user_pages_fast(unsigned long start, int nr_pages,
> >        */
> >       if (WARN_ON_ONCE(gup_flags & FOLL_PIN))
> >               return -EINVAL;
> > +     if (nr_pages <= 0)
> > +             return 0;
>
> I think the documentation may be wrong here...  Is there a caller who expects a
> return of 0 for this behavior?
>

My understanding is -
{get/pin}_user_pages_fast() -> internal_get_user_pages_fast()

Inside internal_get_user_pages_fast()
...
start = untagged_addr(start) & PAGE_MASK;
addr = start;
len = (unsigned long) nr_pages << PAGE_SHIFT;
end = start + len;

if (end <= start)
return 0;
...
This is the only place where {get/pin}_user_pages_fast() returns 0 which
indirectly checks for nr_pages <= 0. For each call to
{get/pin}_user_pages_fast()
we end up checking *nr_pages <= 0* anyway.

There are some instances where caller of these APIs handles return
value 0 as well. Example -
arch/ia64/kernel/err_inject.c#L145
arch/powerpc/kvm/book3s_64_mmu_hv.c#L582
arch/powerpc/kvm/book3s_64_mmu_hv.c#L1174
drivers/staging/gasket/gasket_page_table.c#L489
drivers/rapidio/devices/rio_mport_cdev.c#L865
drivers/platform/goldfish/goldfish_pipe.c#L277
drivers/gpu/drm/via/via_dmablit.c#L242
(some of the error handling looks incorrect)

If we end up checking *nr_pages <= 0* inside  internal_get_user_pages_fast(),
then why not at first place like this patch does ?

2nd opinion is, inside internal_get_user_pages_fast(), for *nr_pages
<= 0* better
to return -ERRNO rather than 0 ?