[SRU][P][PATCH 3/6] vfio/type1: Catch zero from pin_user_pages_remote()
Mitchell Augustin
mitchell.augustin at canonical.com
Wed May 28 22:10:48 UTC 2025
From: Alex Williamson <alex.williamson at redhat.com>
BugLink: https://bugs.launchpad.net/bugs/2111861
pin_user_pages_remote() can currently return zero for invalid args
or zero nr_pages, neither of which should ever happen. However
vaddr_get_pfns() indicates it should only ever return a positive
value or -errno and there's a theoretical case where this can slip
through and be unhandled by callers. Therefore convert zero to
-EFAULT.
Reviewed-by: Peter Xu <peterx at redhat.com>
Reviewed-by: "Mitchell Augustin" <mitchell.augustin at canonical.com>
Tested-by: "Mitchell Augustin" <mitchell.augustin at canonical.com>
Reviewed-by: Jason Gunthorpe <jgg at nvidia.com>
Signed-off-by: Alex Williamson <alex.williamson at redhat.com>
(cherry picked from commit afe84f3b7a26037b258be0f0a1e1754fc1db37e8)
Signed-off-by: Mitchell Augustin <mitchell.augustin at canonical.com>
---
drivers/vfio/vfio_iommu_type1.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 775a4572f815..2e95f5f4d881 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -574,6 +574,8 @@ static int vaddr_get_pfns(struct mm_struct *mm, unsigned long vaddr,
if (ret > 0) {
*pfn = page_to_pfn(pages[0]);
goto done;
+ } else if (!ret) {
+ ret = -EFAULT;
}
vaddr = untagged_addr_remote(mm, vaddr);
--
2.43.0
More information about the kernel-team
mailing list