| Message ID | d04e5fc2-7b2b-4fb1-a9d7-17b55ecb9986@moroto.mountain (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | accel/qaic: Improve bounds checking in encode/decode | expand |
On 6/21/2023 1:22 AM, Dan Carpenter wrote: > If get_user_pages_fast() allocates some pages but not as many as we > wanted, then the current code leaks those pages. Call put_page() on > the pages before returning. > > Fixes: 129776ac2e38 ("accel/qaic: Add control path") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
On 6/21/2023 12:52 PM, Dan Carpenter wrote: > If get_user_pages_fast() allocates some pages but not as many as we > wanted, then the current code leaks those pages. Call put_page() on > the pages before returning. > > Fixes: 129776ac2e38 ("accel/qaic: Add control path") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > drivers/accel/qaic/qaic_control.c | 7 +++++-- > 1 file changed, 5 insertions(+), 2 deletions(-) > > diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c > index 03932197f1ac..7c3f9009617f 100644 > --- a/drivers/accel/qaic/qaic_control.c > +++ b/drivers/accel/qaic/qaic_control.c > @@ -424,9 +424,12 @@ static int find_and_map_user_pages(struct qaic_device *qdev, > } > > ret = get_user_pages_fast(xfer_start_addr, nr_pages, 0, page_list); > - if (ret < 0 || ret != nr_pages) { > - ret = -EFAULT; > + if (ret < 0) > goto free_page_list; > + if (ret != nr_pages) { > + nr_pages = ret; > + ret = -EFAULT; > + goto put_pages; > } > > sgt = kmalloc(sizeof(*sgt), GFP_KERNEL); Thank you for catching this :) Reviewed-by: Pranjal Ramajor Asha Kanojiya <quic_pkanojiy@quicinc.com>
diff --git a/drivers/accel/qaic/qaic_control.c b/drivers/accel/qaic/qaic_control.c index 03932197f1ac..7c3f9009617f 100644 --- a/drivers/accel/qaic/qaic_control.c +++ b/drivers/accel/qaic/qaic_control.c @@ -424,9 +424,12 @@ static int find_and_map_user_pages(struct qaic_device *qdev, } ret = get_user_pages_fast(xfer_start_addr, nr_pages, 0, page_list); - if (ret < 0 || ret != nr_pages) { - ret = -EFAULT; + if (ret < 0) goto free_page_list; + if (ret != nr_pages) { + nr_pages = ret; + ret = -EFAULT; + goto put_pages; } sgt = kmalloc(sizeof(*sgt), GFP_KERNEL);
If get_user_pages_fast() allocates some pages but not as many as we wanted, then the current code leaks those pages. Call put_page() on the pages before returning. Fixes: 129776ac2e38 ("accel/qaic: Add control path") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- drivers/accel/qaic/qaic_control.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)