lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Sun, 17 May 2020 16:56:19 -0700
From:   John Hubbard <jhubbard@...dia.com>
To:     LKML <linux-kernel@...r.kernel.org>
CC:     John Hubbard <jhubbard@...dia.com>,
        Matt Porter <mporter@...nel.crashing.org>,
        Alexandre Bounine <alex.bou9@...il.com>,
        Sumit Semwal <sumit.semwal@...aro.org>,
        Dan Carpenter <dan.carpenter@...cle.com>,
        Andrew Morton <akpm@...ux-foundation.org>,
        <linux-media@...r.kernel.org>, <stable@...r.kernel.org>
Subject: [PATCH 1/2] rapidio: fix an error in get_user_pages_fast() error handling

In the case of get_user_pages_fast() returning fewer pages than
requested, rio_dma_transfer() does not quite do the right thing.
It attempts to release all the pages that were requested, rather
than just the pages that were pinned.

Fix the error handling so that only the pages that were successfully
pinned are released.

Fixes: e8de370188d0 ("rapidio: add mport char device driver")
Cc: Matt Porter <mporter@...nel.crashing.org>
Cc: Alexandre Bounine <alex.bou9@...il.com>
Cc: Sumit Semwal <sumit.semwal@...aro.org>
Cc: Dan Carpenter <dan.carpenter@...cle.com>
Cc: Andrew Morton <akpm@...ux-foundation.org>
Cc: linux-media@...r.kernel.org
Cc: stable@...r.kernel.org
Signed-off-by: John Hubbard <jhubbard@...dia.com>
---
 drivers/rapidio/devices/rio_mport_cdev.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/rapidio/devices/rio_mport_cdev.c b/drivers/rapidio/devices/rio_mport_cdev.c
index 8155f59ece38..10af330153b5 100644
--- a/drivers/rapidio/devices/rio_mport_cdev.c
+++ b/drivers/rapidio/devices/rio_mport_cdev.c
@@ -877,6 +877,11 @@ rio_dma_transfer(struct file *filp, u32 transfer_mode,
 				rmcd_error("pinned %ld out of %ld pages",
 					   pinned, nr_pages);
 			ret = -EFAULT;
+			/*
+			 * Set nr_pages up to mean "how many pages to unpin, in
+			 * the error handler:
+			 */
+			nr_pages = pinned;
 			goto err_pg;
 		}
 
-- 
2.26.2

Powered by blists - more mailing lists