The check i > npage at the end of vfio_iommu_type1_unpin_pages is unused
unless npage < 0, but if npage < 0, this function will return npage, which
should return -EINVAL instead. So let's just check the parameter npage at
the start of the function. By the way, replace unpin_exit with break.
Signed-off-by: Shenming Lu <[email protected]>
---
drivers/vfio/vfio_iommu_type1.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 45cbfd4879a5..fd4213c41743 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -960,7 +960,7 @@ static int vfio_iommu_type1_unpin_pages(void *iommu_data,
bool do_accounting;
int i;
- if (!iommu || !user_pfn)
+ if (!iommu || !user_pfn || npage <= 0)
return -EINVAL;
/* Supported for v2 version only */
@@ -977,13 +977,13 @@ static int vfio_iommu_type1_unpin_pages(void *iommu_data,
iova = user_pfn[i] << PAGE_SHIFT;
dma = vfio_find_dma(iommu, iova, PAGE_SIZE);
if (!dma)
- goto unpin_exit;
+ break;
+
vfio_unpin_page_external(dma, iova, do_accounting);
}
-unpin_exit:
mutex_unlock(&iommu->lock);
- return i > npage ? npage : (i > 0 ? i : -EINVAL);
+ return i > 0 ? i : -EINVAL;
}
static long vfio_sync_unpin(struct vfio_dma *dma, struct vfio_domain *domain,
--
2.19.1
On Tue, 6 Apr 2021 21:50:09 +0800
Shenming Lu <[email protected]> wrote:
> The check i > npage at the end of vfio_iommu_type1_unpin_pages is unused
> unless npage < 0, but if npage < 0, this function will return npage, which
> should return -EINVAL instead. So let's just check the parameter npage at
> the start of the function. By the way, replace unpin_exit with break.
>
> Signed-off-by: Shenming Lu <[email protected]>
> ---
> drivers/vfio/vfio_iommu_type1.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
> index 45cbfd4879a5..fd4213c41743 100644
> --- a/drivers/vfio/vfio_iommu_type1.c
> +++ b/drivers/vfio/vfio_iommu_type1.c
> @@ -960,7 +960,7 @@ static int vfio_iommu_type1_unpin_pages(void *iommu_data,
> bool do_accounting;
> int i;
>
> - if (!iommu || !user_pfn)
> + if (!iommu || !user_pfn || npage <= 0)
> return -EINVAL;
>
> /* Supported for v2 version only */
> @@ -977,13 +977,13 @@ static int vfio_iommu_type1_unpin_pages(void *iommu_data,
> iova = user_pfn[i] << PAGE_SHIFT;
> dma = vfio_find_dma(iommu, iova, PAGE_SIZE);
> if (!dma)
> - goto unpin_exit;
> + break;
> +
> vfio_unpin_page_external(dma, iova, do_accounting);
> }
>
> -unpin_exit:
> mutex_unlock(&iommu->lock);
> - return i > npage ? npage : (i > 0 ? i : -EINVAL);
> + return i > 0 ? i : -EINVAL;
> }
>
> static long vfio_sync_unpin(struct vfio_dma *dma, struct vfio_domain *domain,
Very odd behavior previously. Applied to vfio next branch for v5.13.
Thanks,
Alex