[SRU][P][PATCH 3/6] vfio/type1: Catch zero from pin_user_pages_remote()

Mitchell Augustin mitchell.augustin at canonical.com
Wed May 28 22:10:48 UTC 2025


From: Alex Williamson <alex.williamson at redhat.com>

BugLink: https://bugs.launchpad.net/bugs/2111861

pin_user_pages_remote() can currently return zero for invalid args
or zero nr_pages, neither of which should ever happen.  However
vaddr_get_pfns() indicates it should only ever return a positive
value or -errno and there's a theoretical case where this can slip
through and be unhandled by callers.  Therefore convert zero to
-EFAULT.

Reviewed-by: Peter Xu <peterx at redhat.com>
Reviewed-by: "Mitchell Augustin" <mitchell.augustin at canonical.com>
Tested-by: "Mitchell Augustin" <mitchell.augustin at canonical.com>
Reviewed-by: Jason Gunthorpe <jgg at nvidia.com>
Signed-off-by: Alex Williamson <alex.williamson at redhat.com>
(cherry picked from commit afe84f3b7a26037b258be0f0a1e1754fc1db37e8)
Signed-off-by: Mitchell Augustin <mitchell.augustin at canonical.com>
---
 drivers/vfio/vfio_iommu_type1.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 775a4572f815..2e95f5f4d881 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -574,6 +574,8 @@ static int vaddr_get_pfns(struct mm_struct *mm, unsigned long vaddr,
 	if (ret > 0) {
 		*pfn = page_to_pfn(pages[0]);
 		goto done;
+	} else if (!ret) {
+		ret = -EFAULT;
 	}
 
 	vaddr = untagged_addr_remote(mm, vaddr);
-- 
2.43.0




More information about the kernel-team mailing list