Commit f78cdbd7 authored by John Hubbard's avatar John Hubbard Committed by David S. Miller

rds: fix crash in rds_info_getsockopt()

The conversion to pin_user_pages() had a bug: it overlooked
the case of allocation of pages failing. Fix that by restoring
an equivalent check.

Reported-by: syzbot+118ac0af4ac7f785a45b@syzkaller.appspotmail.com
Fixes: dbfe7d74 ("rds: convert get_user_pages() --> pin_user_pages()")

Cc: David S. Miller <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
Cc: linux-rdma@vger.kernel.org
Cc: rds-devel@oss.oracle.com
Signed-off-by: default avatarJohn Hubbard <jhubbard@nvidia.com>
Acked-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4f65e2f4
...@@ -234,7 +234,8 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval, ...@@ -234,7 +234,8 @@ int rds_info_getsockopt(struct socket *sock, int optname, char __user *optval,
ret = -EFAULT; ret = -EFAULT;
out: out:
unpin_user_pages(pages, nr_pages); if (pages)
unpin_user_pages(pages, nr_pages);
kfree(pages); kfree(pages);
return ret; return ret;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment