There is a bug, when get_user_pages() failed but partially pinned
pages are not unpinned. Fixed it.
Also, int is more appropriate type for rv. Changed it.
Signed-off-by: Souptick Joarder <[email protected]>
Cc: John Hubbard <[email protected]>
Cc: Bharath Vedartham <[email protected]>
Cc: Dan Carpenter <[email protected]>
---
drivers/staging/kpc2000/kpc_dma/fileops.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/kpc2000/kpc_dma/fileops.c b/drivers/staging/kpc2000/kpc_dma/fileops.c
index 8975346..b136353 100644
--- a/drivers/staging/kpc2000/kpc_dma/fileops.c
+++ b/drivers/staging/kpc2000/kpc_dma/fileops.c
@@ -35,7 +35,7 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
unsigned long iov_base, size_t iov_len)
{
unsigned int i = 0;
- long rv = 0;
+ int rv = 0;
struct kpc_dma_device *ldev;
struct aio_cb_data *acd;
DECLARE_COMPLETION_ONSTACK(done);
@@ -193,6 +193,10 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
put_page(acd->user_pages[i]);
err_get_user_pages:
+ if (rv > 0) {
+ for (i = 0; i < rv; i++)
+ put_pages(acd->user_pages[i])
+ }
kfree(acd->user_pages);
err_alloc_userpages:
kfree(acd);
--
1.9.1
On Wed, Jun 17, 2020 at 07:57:20AM +0530, Souptick Joarder wrote:
> There is a bug, when get_user_pages() failed but partially pinned
> pages are not unpinned. Fixed it.
>
> Also, int is more appropriate type for rv. Changed it.
>
> Signed-off-by: Souptick Joarder <[email protected]>
> Cc: John Hubbard <[email protected]>
> Cc: Bharath Vedartham <[email protected]>
> Cc: Dan Carpenter <[email protected]>
> ---
> drivers/staging/kpc2000/kpc_dma/fileops.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/staging/kpc2000/kpc_dma/fileops.c b/drivers/staging/kpc2000/kpc_dma/fileops.c
> index 8975346..b136353 100644
> --- a/drivers/staging/kpc2000/kpc_dma/fileops.c
> +++ b/drivers/staging/kpc2000/kpc_dma/fileops.c
> @@ -35,7 +35,7 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
> unsigned long iov_base, size_t iov_len)
> {
> unsigned int i = 0;
> - long rv = 0;
> + int rv = 0;
> struct kpc_dma_device *ldev;
> struct aio_cb_data *acd;
> DECLARE_COMPLETION_ONSTACK(done);
> @@ -193,6 +193,10 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
> put_page(acd->user_pages[i]);
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> err_get_user_pages:
> + if (rv > 0) {
> + for (i = 0; i < rv; i++)
> + put_pages(acd->user_pages[i])
^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> + }
This isn't a complete fix. "rv" is the negative error code but here we
are returning a positive value on this path. Also it's ugly to have
same put_page() loop repeated twice.
It would be better to write it like this:
rv = get_user_pages(iov_base, acd->page_count, FOLL_TOUCH | FOLL_WRITE | FOLL_GET, acd->user_pages, NULL);
mmap_read_unlock(current->mm); /* release the semaphore */
if (rv < 0)
goto free_pages;
if (rv != acd->page_count) {
acd->page_count = rv;
rv = -EFAULT;
goto put_pages;
}
...
put_pages:
for (i = 0 ; i < acd->page_count ; i++)
put_pages(acd->user_pages[i]);
free_pages:
kfree(acd->user_pages);
regards,
dan carpenter
On Wed, Jun 17, 2020 at 4:43 PM Dan Carpenter <[email protected]> wrote:
>
> On Wed, Jun 17, 2020 at 07:57:20AM +0530, Souptick Joarder wrote:
> > There is a bug, when get_user_pages() failed but partially pinned
> > pages are not unpinned. Fixed it.
> >
> > Also, int is more appropriate type for rv. Changed it.
> >
> > Signed-off-by: Souptick Joarder <[email protected]>
> > Cc: John Hubbard <[email protected]>
> > Cc: Bharath Vedartham <[email protected]>
> > Cc: Dan Carpenter <[email protected]>
> > ---
> > drivers/staging/kpc2000/kpc_dma/fileops.c | 6 +++++-
> > 1 file changed, 5 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/staging/kpc2000/kpc_dma/fileops.c b/drivers/staging/kpc2000/kpc_dma/fileops.c
> > index 8975346..b136353 100644
> > --- a/drivers/staging/kpc2000/kpc_dma/fileops.c
> > +++ b/drivers/staging/kpc2000/kpc_dma/fileops.c
> > @@ -35,7 +35,7 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
> > unsigned long iov_base, size_t iov_len)
> > {
> > unsigned int i = 0;
> > - long rv = 0;
> > + int rv = 0;
> > struct kpc_dma_device *ldev;
> > struct aio_cb_data *acd;
> > DECLARE_COMPLETION_ONSTACK(done);
> > @@ -193,6 +193,10 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
> > put_page(acd->user_pages[i]);
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> >
> > err_get_user_pages:
> > + if (rv > 0) {
> > + for (i = 0; i < rv; i++)
> > + put_pages(acd->user_pages[i])
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
>
> > + }
>
> This isn't a complete fix. "rv" is the negative error code but here we
> are returning a positive value on this path.
In case of error of get_user_pages(), it will return -errno, 0 and 3rd one is
(rv > 0 && rv != acd->page_count). When rv is -errno or 0 there is no need
to call put_pages() in error path. But for 3rd case partially mapped pages
need to unpin.
Correct me if I am missing anything.
>Also it's ugly to have
> same put_page() loop repeated twice.
Yes, I agree, but these are intermediate steps. Patch [4/4] of this series
finally did the same.
>
> It would be better to write it like this:
>
> rv = get_user_pages(iov_base, acd->page_count, FOLL_TOUCH | FOLL_WRITE | FOLL_GET, acd->user_pages, NULL);
> mmap_read_unlock(current->mm); /* release the semaphore */
> if (rv < 0)
> goto free_pages;
> if (rv != acd->page_count) {
> acd->page_count = rv;
> rv = -EFAULT;
> goto put_pages;
> }
>
> ...
>
> put_pages:
> for (i = 0 ; i < acd->page_count ; i++)
> put_pages(acd->user_pages[i]);
> free_pages:
> kfree(acd->user_pages);
>
> regards,
> dan carpenter
>
On Wed, Jun 17, 2020 at 11:13:32PM +0530, Souptick Joarder wrote:
> On Wed, Jun 17, 2020 at 4:43 PM Dan Carpenter <[email protected]> wrote:
> >
> > On Wed, Jun 17, 2020 at 07:57:20AM +0530, Souptick Joarder wrote:
> > > There is a bug, when get_user_pages() failed but partially pinned
> > > pages are not unpinned. Fixed it.
> > >
> > > Also, int is more appropriate type for rv. Changed it.
> > >
> > > Signed-off-by: Souptick Joarder <[email protected]>
> > > Cc: John Hubbard <[email protected]>
> > > Cc: Bharath Vedartham <[email protected]>
> > > Cc: Dan Carpenter <[email protected]>
> > > ---
> > > drivers/staging/kpc2000/kpc_dma/fileops.c | 6 +++++-
> > > 1 file changed, 5 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/drivers/staging/kpc2000/kpc_dma/fileops.c b/drivers/staging/kpc2000/kpc_dma/fileops.c
> > > index 8975346..b136353 100644
> > > --- a/drivers/staging/kpc2000/kpc_dma/fileops.c
> > > +++ b/drivers/staging/kpc2000/kpc_dma/fileops.c
> > > @@ -35,7 +35,7 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
> > > unsigned long iov_base, size_t iov_len)
> > > {
> > > unsigned int i = 0;
> > > - long rv = 0;
> > > + int rv = 0;
> > > struct kpc_dma_device *ldev;
> > > struct aio_cb_data *acd;
> > > DECLARE_COMPLETION_ONSTACK(done);
> > > @@ -193,6 +193,10 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
> > > put_page(acd->user_pages[i]);
> > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > >
> > > err_get_user_pages:
> > > + if (rv > 0) {
> > > + for (i = 0; i < rv; i++)
> > > + put_pages(acd->user_pages[i])
> > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> >
> > > + }
> >
> > This isn't a complete fix. "rv" is the negative error code but here we
> > are returning a positive value on this path.
>
> In case of error of get_user_pages(), it will return -errno, 0 and 3rd one is
> (rv > 0 && rv != acd->page_count). When rv is -errno or 0 there is no need
> to call put_pages() in error path. But for 3rd case partially mapped pages
> need to unpin.
>
> Correct me if I am missing anything.
>
182 kfree(acd);
183 }
184 return rv;
185
186 err_descr_too_many:
187 unlock_engine(ldev);
188 dma_unmap_sg(&ldev->pldev->dev, acd->sgt.sgl, acd->sgt.nents, ldev->dir);
189 sg_free_table(&acd->sgt);
190 err_dma_map_sg:
191 err_alloc_sg_table:
192 for (i = 0 ; i < acd->page_count ; i++)
193 put_page(acd->user_pages[i]);
194
195 err_get_user_pages:
196 if (rv > 0) {
^^^^^^
"rv" is positive.
197 for (i = 0; i < rv; i++)
198 put_pages(acd->user_pages[i])
199 }
200 kfree(acd->user_pages);
201 err_alloc_userpages:
202 kfree(acd);
203 dev_dbg(&priv->ldev->pldev->dev, "%s returning with error %ld\n", __func__, rv);
204 return rv;
^^
"rv" is still positive but it should be -EFAULT.
205 }
regards,
dan carpenter
On Wed, Jun 17, 2020 at 11:29 PM Dan Carpenter <[email protected]> wrote:
>
> On Wed, Jun 17, 2020 at 11:13:32PM +0530, Souptick Joarder wrote:
> > On Wed, Jun 17, 2020 at 4:43 PM Dan Carpenter <[email protected]> wrote:
> > >
> > > On Wed, Jun 17, 2020 at 07:57:20AM +0530, Souptick Joarder wrote:
> > > > There is a bug, when get_user_pages() failed but partially pinned
> > > > pages are not unpinned. Fixed it.
> > > >
> > > > Also, int is more appropriate type for rv. Changed it.
> > > >
> > > > Signed-off-by: Souptick Joarder <[email protected]>
> > > > Cc: John Hubbard <[email protected]>
> > > > Cc: Bharath Vedartham <[email protected]>
> > > > Cc: Dan Carpenter <[email protected]>
> > > > ---
> > > > drivers/staging/kpc2000/kpc_dma/fileops.c | 6 +++++-
> > > > 1 file changed, 5 insertions(+), 1 deletion(-)
> > > >
> > > > diff --git a/drivers/staging/kpc2000/kpc_dma/fileops.c b/drivers/staging/kpc2000/kpc_dma/fileops.c
> > > > index 8975346..b136353 100644
> > > > --- a/drivers/staging/kpc2000/kpc_dma/fileops.c
> > > > +++ b/drivers/staging/kpc2000/kpc_dma/fileops.c
> > > > @@ -35,7 +35,7 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
> > > > unsigned long iov_base, size_t iov_len)
> > > > {
> > > > unsigned int i = 0;
> > > > - long rv = 0;
> > > > + int rv = 0;
> > > > struct kpc_dma_device *ldev;
> > > > struct aio_cb_data *acd;
> > > > DECLARE_COMPLETION_ONSTACK(done);
> > > > @@ -193,6 +193,10 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
> > > > put_page(acd->user_pages[i]);
> > > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > >
> > > > err_get_user_pages:
> > > > + if (rv > 0) {
> > > > + for (i = 0; i < rv; i++)
> > > > + put_pages(acd->user_pages[i])
> > > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > >
> > > > + }
> > >
> > > This isn't a complete fix. "rv" is the negative error code but here we
> > > are returning a positive value on this path.
> >
> > In case of error of get_user_pages(), it will return -errno, 0 and 3rd one is
> > (rv > 0 && rv != acd->page_count). When rv is -errno or 0 there is no need
> > to call put_pages() in error path. But for 3rd case partially mapped pages
> > need to unpin.
> >
> > Correct me if I am missing anything.
> >
>
> 182 kfree(acd);
> 183 }
> 184 return rv;
> 185
> 186 err_descr_too_many:
> 187 unlock_engine(ldev);
> 188 dma_unmap_sg(&ldev->pldev->dev, acd->sgt.sgl, acd->sgt.nents, ldev->dir);
> 189 sg_free_table(&acd->sgt);
> 190 err_dma_map_sg:
> 191 err_alloc_sg_table:
> 192 for (i = 0 ; i < acd->page_count ; i++)
> 193 put_page(acd->user_pages[i]);
> 194
> 195 err_get_user_pages:
> 196 if (rv > 0) {
> ^^^^^^
> "rv" is positive.
>
> 197 for (i = 0; i < rv; i++)
> 198 put_pages(acd->user_pages[i])
> 199 }
> 200 kfree(acd->user_pages);
> 201 err_alloc_userpages:
> 202 kfree(acd);
> 203 dev_dbg(&priv->ldev->pldev->dev, "%s returning with error %ld\n", __func__, rv);
> 204 return rv;
> ^^
> "rv" is still positive but it should be -EFAULT.
>
Ahh, my mistake. Will correct it in v2.
Do other patches in the series looks good ?
On Thu, Jun 18, 2020 at 12:59:57AM +0530, Souptick Joarder wrote:
> On Wed, Jun 17, 2020 at 11:29 PM Dan Carpenter <[email protected]> wrote:
> >
> > On Wed, Jun 17, 2020 at 11:13:32PM +0530, Souptick Joarder wrote:
> > > On Wed, Jun 17, 2020 at 4:43 PM Dan Carpenter <[email protected]> wrote:
> > > >
> > > > On Wed, Jun 17, 2020 at 07:57:20AM +0530, Souptick Joarder wrote:
> > > > > There is a bug, when get_user_pages() failed but partially pinned
> > > > > pages are not unpinned. Fixed it.
> > > > >
> > > > > Also, int is more appropriate type for rv. Changed it.
> > > > >
> > > > > Signed-off-by: Souptick Joarder <[email protected]>
> > > > > Cc: John Hubbard <[email protected]>
> > > > > Cc: Bharath Vedartham <[email protected]>
> > > > > Cc: Dan Carpenter <[email protected]>
> > > > > ---
> > > > > drivers/staging/kpc2000/kpc_dma/fileops.c | 6 +++++-
> > > > > 1 file changed, 5 insertions(+), 1 deletion(-)
> > > > >
> > > > > diff --git a/drivers/staging/kpc2000/kpc_dma/fileops.c b/drivers/staging/kpc2000/kpc_dma/fileops.c
> > > > > index 8975346..b136353 100644
> > > > > --- a/drivers/staging/kpc2000/kpc_dma/fileops.c
> > > > > +++ b/drivers/staging/kpc2000/kpc_dma/fileops.c
> > > > > @@ -35,7 +35,7 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
> > > > > unsigned long iov_base, size_t iov_len)
> > > > > {
> > > > > unsigned int i = 0;
> > > > > - long rv = 0;
> > > > > + int rv = 0;
> > > > > struct kpc_dma_device *ldev;
> > > > > struct aio_cb_data *acd;
> > > > > DECLARE_COMPLETION_ONSTACK(done);
> > > > > @@ -193,6 +193,10 @@ static int kpc_dma_transfer(struct dev_private_data *priv,
> > > > > put_page(acd->user_pages[i]);
> > > > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > > >
> > > > > err_get_user_pages:
> > > > > + if (rv > 0) {
> > > > > + for (i = 0; i < rv; i++)
> > > > > + put_pages(acd->user_pages[i])
> > > > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> > > >
> > > > > + }
> > > >
> > > > This isn't a complete fix. "rv" is the negative error code but here we
> > > > are returning a positive value on this path.
> > >
> > > In case of error of get_user_pages(), it will return -errno, 0 and 3rd one is
> > > (rv > 0 && rv != acd->page_count). When rv is -errno or 0 there is no need
> > > to call put_pages() in error path. But for 3rd case partially mapped pages
> > > need to unpin.
> > >
> > > Correct me if I am missing anything.
> > >
> >
> > 182 kfree(acd);
> > 183 }
> > 184 return rv;
> > 185
> > 186 err_descr_too_many:
> > 187 unlock_engine(ldev);
> > 188 dma_unmap_sg(&ldev->pldev->dev, acd->sgt.sgl, acd->sgt.nents, ldev->dir);
> > 189 sg_free_table(&acd->sgt);
> > 190 err_dma_map_sg:
> > 191 err_alloc_sg_table:
> > 192 for (i = 0 ; i < acd->page_count ; i++)
> > 193 put_page(acd->user_pages[i]);
> > 194
> > 195 err_get_user_pages:
> > 196 if (rv > 0) {
> > ^^^^^^
> > "rv" is positive.
> >
> > 197 for (i = 0; i < rv; i++)
> > 198 put_pages(acd->user_pages[i])
> > 199 }
> > 200 kfree(acd->user_pages);
> > 201 err_alloc_userpages:
> > 202 kfree(acd);
> > 203 dev_dbg(&priv->ldev->pldev->dev, "%s returning with error %ld\n", __func__, rv);
> > 204 return rv;
> > ^^
> > "rv" is still positive but it should be -EFAULT.
> >
>
> Ahh, my mistake. Will correct it in v2.
> Do other patches in the series looks good ?
The others will have to be re-worked if you change patch 1/4, especially
patch 4/4. But otherwise it seems okay with me.
regards,
dan carpenter