From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754012AbdJaXBT (ORCPT ); Tue, 31 Oct 2017 19:01:19 -0400 Received: from mail.efficios.com ([167.114.142.141]:48549 "EHLO mail.efficios.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753931AbdJaXBS (ORCPT ); Tue, 31 Oct 2017 19:01:18 -0400 From: Mathieu Desnoyers To: Alexander Viro Cc: linux-kernel@vger.kernel.org, Mathieu Desnoyers , George Zhang , Andy king , Dmitry Torokhov , Greg Kroah-Hartman , linux-fsdevel@vger.kernel.org Subject: [PATCH 1/1] Fix: vmw_vmci driver get_user_pages_fast error handling Date: Tue, 31 Oct 2017 19:00:38 -0400 Message-Id: <20171031230038.7476-1-mathieu.desnoyers@efficios.com> X-Mailer: git-send-email 2.11.0 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Comparing a signed return value against an unsigned num_pages field performs the comparison as "unsigned", and therefore mistakenly considers get_user_pages_fast() errors as success. Signed-off-by: Mathieu Desnoyers CC: Alexander Viro CC: George Zhang CC: Andy king CC: Dmitry Torokhov CC: Greg Kroah-Hartman CC: linux-fsdevel@vger.kernel.org --- drivers/misc/vmw_vmci/vmci_queue_pair.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c b/drivers/misc/vmw_vmci/vmci_queue_pair.c index 8af5c2672f71..f71db848ce81 100644 --- a/drivers/misc/vmw_vmci/vmci_queue_pair.c +++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c @@ -755,7 +755,7 @@ static int qp_host_get_user_memory(u64 produce_uva, retval = get_user_pages_fast((uintptr_t) produce_uva, produce_q->kernel_if->num_pages, 1, produce_q->kernel_if->u.h.header_page); - if (retval < produce_q->kernel_if->num_pages) { + if (retval < 0 || retval < produce_q->kernel_if->num_pages) { pr_debug("get_user_pages_fast(produce) failed (retval=%d)", retval); qp_release_pages(produce_q->kernel_if->u.h.header_page, @@ -767,7 +767,7 @@ static int qp_host_get_user_memory(u64 produce_uva, retval = get_user_pages_fast((uintptr_t) consume_uva, consume_q->kernel_if->num_pages, 1, consume_q->kernel_if->u.h.header_page); - if (retval < consume_q->kernel_if->num_pages) { + if (retval < 0 || retval < consume_q->kernel_if->num_pages) { pr_debug("get_user_pages_fast(consume) failed (retval=%d)", retval); qp_release_pages(consume_q->kernel_if->u.h.header_page, -- 2.11.0