linux-kernel - Re: [PATCH 1/4] staging: kpc2000: Unpin partial pinned pages

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20200617111321.GP4282@kadam>
Date:   Wed, 17 Jun 2020 14:13:22 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Souptick Joarder <jrdr.linux@...il.com>
Cc:     gregkh@...uxfoundation.org, jane.pnx9@...il.com, pakki001@....edu,
        ldufour@...ux.ibm.com, harshjain32@...il.com, simon@...anor.nu,
        walken@...gle.com, devel@...verdev.osuosl.org,
        linux-kernel@...r.kernel.org, John Hubbard <jhubbard@...dia.com>,
        Bharath Vedartham <linux.bhar@...il.com>
Subject: Re: [PATCH 1/4] staging: kpc2000: Unpin partial pinned pages

On Wed, Jun 17, 2020 at 07:57:20AM +0530, Souptick Joarder wrote:
> There is a bug, when get_user_pages() failed but partially pinned
> pages are not unpinned. Fixed it.
> 
> Also, int is more appropriate type for rv. Changed it.
> 
> Signed-off-by: Souptick Joarder <jrdr.linux@...il.com>
> Cc: John Hubbard <jhubbard@...dia.com>
> Cc: Bharath Vedartham <linux.bhar@...il.com>
> Cc: Dan Carpenter <dan.carpenter@...cle.com>
> ---
>  drivers/staging/kpc2000/kpc_dma/fileops.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/kpc2000/kpc_dma/fileops.c b/drivers/staging/kpc2000/kpc_dma/fileops.c
> index 8975346..b136353 100644
> --- a/drivers/staging/kpc2000/kpc_dma/fileops.c
> +++ b/drivers/staging/kpc2000/kpc_dma/fileops.c
> @@ -35,7 +35,7 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
>  			    unsigned long iov_base, size_t iov_len)
>  {
>  	unsigned int i = 0;
> -	long rv = 0;
> +	int rv = 0;
>  	struct kpc_dma_device *ldev;
>  	struct aio_cb_data *acd;
>  	DECLARE_COMPLETION_ONSTACK(done);
> @@ -193,6 +193,10 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
>  		put_page(acd->user_pages[i]);
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>  
>   err_get_user_pages:
> +	if (rv > 0) {
> +		for (i = 0; i < rv; i++)
> +			put_pages(acd->user_pages[i])
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^

> +	}

This isn't a complete fix.  "rv" is the negative error code but here we
are returning a positive value on this path.  Also it's ugly to have
same put_page() loop repeated twice.

It would be better to write it like this:

	rv = get_user_pages(iov_base, acd->page_count, FOLL_TOUCH | FOLL_WRITE | FOLL_GET, acd->user_pages, NULL);
	mmap_read_unlock(current->mm);        /*  release the semaphore */
	if (rv < 0)
		goto free_pages;
	if (rv != acd->page_count) {
		acd->page_count = rv;
		rv = -EFAULT;
		goto put_pages;
	}

	...

put_pages:
	for (i = 0 ; i < acd->page_count ; i++)
		put_pages(acd->user_pages[i]);
free_pages:
	kfree(acd->user_pages);

regards,
dan carpenter