• Michael S. Tsirkin's avatar
    get_user_pages_fast(): return -EFAULT on access_ok failure · c61611f7
    Michael S. Tsirkin authored
    get_user_pages_fast is supposed to be a faster drop-in equivalent of
    get_user_pages.  As such, callers expect it to return a negative return
    code when passed an invalid address, and never expect it to return 0
    when passed a positive number of pages, since its documentation says:
    
     * Returns number of pages pinned. This may be fewer than the number
     * requested. If nr_pages is 0 or negative, returns 0. If no pages
     * were pinned, returns -errno.
    
    When get_user_pages_fast fall back on get_user_pages this is exactly
    what happens.  Unfortunately the implementation is inconsistent: it
    returns 0 if passed a kernel address, confusing callers: for example,
    the following is pretty common but does not appear to do the right thing
    with a kernel address:
    
            ret = get_user_pages_fast(addr, 1, writeable, &page);
            if (ret < 0)
                    return ret;
    
    Change get_user_pages_fast to return -EFAULT when supplied a kernel
    address to make it match expectations.
    
    All callers have been audited for consistency with the documented
    semantics.
    
    Link: http://lkml.kernel.org/r/1522962072-182137-4-git-send-email-mst@redhat.com
    Fixes: 5b65c467 ("mm, x86/mm: Fix performance regression in get_user_pages_fast()")
    Signed-off-by: default avatarMichael S. Tsirkin <mst@redhat.com>
    Reported-by: syzbot+6304bf97ef436580fede@syzkaller.appspotmail.com
    Reviewed-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Cc: Huang Ying <ying.huang@intel.com>
    Cc: Jonathan Corbet <corbet@lwn.net>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Thorsten Leemhuis <regressions@leemhuis.info>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    c61611f7
gup.c 49.7 KB