From 146608bb75e6776af4cf42310f583d39311e5334 Mon Sep 17 00:00:00 2001 From: John Hubbard Date: Tue, 13 Oct 2020 16:52:01 -0700 Subject: mm/gup: protect unpin_user_pages() against npages==-ERRNO As suggested by Dan Carpenter, fortify unpin_user_pages() just a bit, against a typical caller mistake: check if the npages arg is really a -ERRNO value, which would blow up the unpinning loop: WARN and return. If this new WARN_ON() fires, then the system *might* be leaking pages (by leaving them pinned), but probably not. More likely, gup/pup returned a hard -ERRNO error to the caller, who erroneously passed it here. Signed-off-by: John Hubbard Signed-off-by: Dan Carpenter Signed-off-by: Andrew Morton Cc: Ira Weiny Cc: Souptick Joarder Link: https://lkml.kernel.org/r/20200917065706.409079-1-jhubbard@nvidia.com Signed-off-by: Linus Torvalds --- mm/gup.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'mm/gup.c') diff --git a/mm/gup.c b/mm/gup.c index 32d0e3ca7fbb..ad617e7f22f5 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -328,6 +328,13 @@ void unpin_user_pages(struct page **pages, unsigned long npages) { unsigned long index; + /* + * If this WARN_ON() fires, then the system *might* be leaking pages (by + * leaving them pinned), but probably not. More likely, gup/pup returned + * a hard -ERRNO error to the caller, who erroneously passed it here. + */ + if (WARN_ON(IS_ERR_VALUE(npages))) + return; /* * TODO: this can be optimized for huge pages: if a series of pages is * physically contiguous and part of the same compound page, then a -- cgit v1.2.3