macvtap: fix recovery from gup errors
Subsystems (2)
PATCH 1/1 macvtap: fix recovery from gup errors
get user pages might fail partially in macvtap zero copy mode. To recover we need to put all pages that we got, but code used a wrong index resulting in double-free errors.
---
Same as the tun patch really. Also stable material.
drivers/net/macvtap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
drivers/net/macvtap.c +3 -2
@@ -524,8 +524,9 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,return -EMSGSIZE ; num_pages =get_user_pages_fast (base, size,0 , &page[i]);if (num_pages != size) { -for (i =0 ; i < num_pages; i++) -put_page (page[i]); +int j; +for (j =0 ; j < num_pages; j++) +put_page (page[i + j]);return -EFAULT ; } truesize = size *PAGE_SIZE ;
Signature · 1 line
MST
Quoted 10 lines · Michael S. Tsirkin
get user pages might fail partially in macvtap zero copy mode. To recover we need to put all pages that we got, but code used a wrong index resulting in double-free errors.
Reported-by Brad Hubbard <[email protected]>Signed-off-by Michael S. Tsirkin <[email protected]>---
Same as the tun patch really. Also stable material.
Quoted 20 lines
drivers/net/macvtap.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)drivers/net/macvtap.c +3
-2@@ -524,8 +524,9 @@ static int zerocopy_sg_from_iovec(struct sk_buff *skb, const struct iovec *from,return -EMSGSIZE ; num_pages =get_user_pages_fast (base, size,0 , &page[i]);if (num_pages != size) { -for (i =0 ; i < num_pages; i++) -put_page (page[i]); +int j; +for (j =0 ; j < num_pages; j++) +put_page (page[i + j]);return -EFAULT ; } truesize = size *PAGE_SIZE ;
From: Jason Wang <[email protected]>
Date: Mon, 24 Jun 2013 11:23:15 +0800
Quoted 6 lines · Michael S. Tsirkin
Quoted 5 lines
get user pages might fail partially in macvtap zero copy mode. To recover we need to put all pages that we got, but code used a wrong index resulting in double-free errors.
Quoted 7 lines
Quoted 5 lines
Reported-by Brad Hubbard <[email protected]>Signed-off-by Michael S. Tsirkin <[email protected]>---
Same as the tun patch really. Also stable material.
Acked-by Jason Wang <[email protected]>
Applied, also with the missing empty line added.