From: John Hubbard <jhubbard@nvidia.com>
Date: Wed, 20 May 2020 19:41:47 +0000 (-0700)
Subject: rds: fix crash in rds_info_getsockopt()
X-Git-Tag: v5.15~3723^2~148
X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=f78cdbd75a57245ecc68f5a40e470933426a082b;p=platform%2Fkernel%2Flinux-starfive.git

rds: fix crash in rds_info_getsockopt()

The conversion to pin_user_pages() had a bug: it overlooked
the case of allocation of pages failing. Fix that by restoring
an equivalent check.

Reported-by: syzbot+118ac0af4ac7f785a45b@syzkaller.appspotmail.com
Fixes: dbfe7d74376e ("rds: convert get_user_pages() --> pin_user_pages()")

Cc: David S. Miller <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
Cc: linux-rdma@vger.kernel.org
Cc: rds-devel@oss.oracle.com
Signed-off-by: John Hubbard <jhubbard@nvidia.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/rds/info.c b/net/rds/info.c
index e1d6356..b6b46a8 100644
--- a/net/rds/info.c
+++ b/net/rds/info.c
@@ -234,7 +234,8 @@ call_func:
 		ret = -EFAULT;
 
 out:
-	unpin_user_pages(pages, nr_pages);
+	if (pages)
+		unpin_user_pages(pages, nr_pages);
 	kfree(pages);
 
 	return ret;