diff options
| author |   John Hubbard <jhubbard@nvidia.com> | 2020-05-20 12:41:47 -0700 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2020-05-20 14:08:06 -0700 |
| commit | f78cdbd75a57245ecc68f5a40e470933426a082b (patch) | |
| tree | 1eba25d38b8ce84cdd1d5d2ee6c0d6fa3a4ac070 /net/rds | |
| parent | net: unexport skb_gro_receive() (diff) | |
| download | linux-dev-f78cdbd75a57245ecc68f5a40e470933426a082b.tar.xz linux-dev-f78cdbd75a57245ecc68f5a40e470933426a082b.zip | |
rds: fix crash in rds_info_getsockopt()
The conversion to pin_user_pages() had a bug: it overlooked
the case of allocation of pages failing. Fix that by restoring
an equivalent check.
Reported-by: syzbot+118ac0af4ac7f785a45b@syzkaller.appspotmail.com
Fixes: dbfe7d74376e ("rds: convert get_user_pages() --> pin_user_pages()")
Cc: David S. Miller <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
Cc: linux-rdma@vger.kernel.org
Cc: rds-devel@oss.oracle.com
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/rds')
| -rw-r--r-- | net/rds/info.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/rds/info.c b/net/rds/info.c index e1d63563e81c..b6b46a8214a0 100644 --- a/net/rds/info.c +++ b/net/rds/info.c @@ -234,7 +234,8 @@ call_func: ret = -EFAULT; out: - unpin_user_pages(pages, nr_pages); + if (pages) + unpin_user_pages(pages, nr_pages); kfree(pages); return ret; |