| Message ID | 20200520194147.127137-1-jhubbard@nvidia.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | rds: fix crash in rds_info_getsockopt() | expand |
On 5/20/20 12:41 PM, John Hubbard wrote: > The conversion to pin_user_pages() had a bug: it overlooked > the case of allocation of pages failing. Fix that by restoring > an equivalent check. > > Reported-by: syzbot+118ac0af4ac7f785a45b@syzkaller.appspotmail.com > Fixes: dbfe7d74376e ("rds: convert get_user_pages() --> pin_user_pages()") > > Cc: David S. Miller <davem@davemloft.net> > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: netdev@vger.kernel.org > Cc: linux-rdma@vger.kernel.org > Cc: rds-devel@oss.oracle.com > Signed-off-by: John Hubbard <jhubbard@nvidia.com> > --- Thanks John !! Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
From: John Hubbard <jhubbard@nvidia.com> Date: Wed, 20 May 2020 12:41:47 -0700 > The conversion to pin_user_pages() had a bug: it overlooked > the case of allocation of pages failing. Fix that by restoring > an equivalent check. > > Reported-by: syzbot+118ac0af4ac7f785a45b@syzkaller.appspotmail.com > Fixes: dbfe7d74376e ("rds: convert get_user_pages() --> pin_user_pages()") > Signed-off-by: John Hubbard <jhubbard@nvidia.com> Applied to net-next, thanks.
diff --git a/net/rds/info.c b/net/rds/info.c index e1d63563e81c..b6b46a8214a0 100644 --- a/net/rds/info.c +++ b/net/rds/info.c @@ -234,7 +234,8 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval, ret = -EFAULT; out: - unpin_user_pages(pages, nr_pages); + if (pages) + unpin_user_pages(pages, nr_pages); kfree(pages); return ret;
The conversion to pin_user_pages() had a bug: it overlooked the case of allocation of pages failing. Fix that by restoring an equivalent check. Reported-by: syzbot+118ac0af4ac7f785a45b@syzkaller.appspotmail.com Fixes: dbfe7d74376e ("rds: convert get_user_pages() --> pin_user_pages()") Cc: David S. Miller <davem@davemloft.net> Cc: Jakub Kicinski <kuba@kernel.org> Cc: netdev@vger.kernel.org Cc: linux-rdma@vger.kernel.org Cc: rds-devel@oss.oracle.com Signed-off-by: John Hubbard <jhubbard@nvidia.com> --- net/rds/info.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)