mm/gup: finish consolidating error handling

From: John Hubbard <[email protected]>

Hi,

Keith Busch and Dan Williams noticed that this patch (which was part of my RFC[1] for the get_user_pages + DMA fix) also fixes a bug. Accordingly, I'm adjusting the changelog and posting this as it's own patch.

[1] https://lkml.kernel.org/r/[email protected]

John Hubbard (1):
mm/gup: finish consolidating error handling

 mm/gup.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

2.19.1

From: John Hubbard <[email protected]>

Commit df06b37ffe5a4 ("mm/gup: cache dev_pagemap while pinning pages") attempted to operate on each page that get_user_pages had retrieved. In order to do that, it created a common exit point from the routine. However, one case was missed, which this patch fixes up.

Also, there was still an unnecessary shadow declaration (with a different type) of the "ret" variable, which this patch removes.

---
 mm/gup.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

index aa43620a3270..8cb68a50dbdf 100644
@@ -702,12 +702,11 @@ static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
 		if (!vma || start >= vma->vm_end) {
 			vma = find_extend_vma(mm, start);
 			if (!vma && in_gate_area(mm, start)) {
-				int ret;
 				ret = get_gate_page(mm, start & PAGE_MASK,
 						gup_flags, &vma,
 						pages ? &pages[i] : NULL);
 				if (ret)
-					return i ? : ret;
+					goto out;
 				ctx.page_mask = 0;
 				goto next_page;
 			}

2.19.1

What is the bug which this supposedly fixes and what is that bug's user-visible impact?

Keith's description of the situation is:

This also fixes a potentially leaked dev_pagemap reference count if a failure occurs when an iteration crosses a vma boundary. I don't think it's normal to have different vma's on a users mapped zone device memory, but good to fix anyway.

I actually thought that this code:

    /* first iteration or cross vma bound */
    if (!vma || start >= vma->vm_end) {
        vma = find_extend_vma(mm, start);
        if (!vma && in_gate_area(mm, start)) {
            ret = get_gate_page(mm, start & PAGE_MASK,
                    gup_flags, &vma,
                    pages ? &pages[i] : NULL);
            if (ret)
                goto out;

...dealt with the "you're trying to pin the gate page, as part of this call", rather than the generic case of crossing a vma boundary. (I think there's a fine point that I must be overlooking.) But it's still a valid case, either way.

thanks,
John Hubbard
NVIDIA