Commit f78cdbd7 authored May 20, 2020 by John Hubbard Committed by David S. Miller May 20, 2020

rds: fix crash in rds_info_getsockopt()



The conversion to pin_user_pages() had a bug: it overlooked
the case of allocation of pages failing. Fix that by restoring
an equivalent check.

Reported-by:  <syzbot+118ac0af4ac7f785a45b@syzkaller.appspotmail.com>
Fixes: dbfe7d74 ("rds: convert get_user_pages() --> pin_user_pages()")

Cc: David S. Miller <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
Cc: linux-rdma@vger.kernel.org
Cc: rds-devel@oss.oracle.com
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 4f65e2f4

net/rds/info.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -234,6 +234,7 @@ call_func:
		ret = -EFAULT;

		out:
		if (pages)
		unpin_user_pages(pages, nr_pages);
		kfree(pages);

Admin message