cf35d6e047
`genwqe_user_vmap()` calls `get_user_pages_fast()` and if the return value is less than the number of pages requested, it frees the pages and returns an error (`-EFAULT`). However, it fails to consider a negative error return value from `get_user_pages_fast()`. In that case, the test `if (rc < m->nr_pages)` will be false (due to promotion of `rc` to a large `unsigned int`) and the code will continue on to call `genwqe_map_pages()` with an invalid list of page pointers. Fix it by bailing out if `get_user_pages_fast()` returns a negative error value. Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Cc: <stable@vger.kernel.org> # 3.14.x # 3.15.x # 3.16.x # 3.17.x Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
---|---|---|
.. | ||
altera-stapl | ||
c2port | ||
carma | ||
cb710 | ||
cxl | ||
echo | ||
eeprom | ||
fuse | ||
genwqe | ||
ibmasm | ||
lis3lv02d | ||
mei | ||
mic | ||
sgi-gru | ||
sgi-xp | ||
ti-st | ||
vmw_vmci | ||
ad525x_dpot-i2c.c | ||
ad525x_dpot-spi.c | ||
ad525x_dpot.c | ||
ad525x_dpot.h | ||
apds990x.c | ||
apds9802als.c | ||
arm-charlcd.c | ||
atmel_tclib.c | ||
atmel-ssc.c | ||
bh1770glc.c | ||
bh1780gli.c | ||
bmp085-i2c.c | ||
bmp085-spi.c | ||
bmp085.c | ||
bmp085.h | ||
cs5535-mfgpt.c | ||
ds1682.c | ||
dummy-irq.c | ||
enclosure.c | ||
fsa9480.c | ||
hmc6352.c | ||
hpilo.c | ||
hpilo.h | ||
ics932s401.c | ||
ioc4.c | ||
isl29003.c | ||
isl29020.c | ||
Kconfig | ||
kgdbts.c | ||
lattice-ecp3-config.c | ||
lkdtm.c | ||
Makefile | ||
pch_phub.c | ||
phantom.c | ||
pti.c | ||
spear13xx_pcie_gadget.c | ||
sram.c | ||
ti_dac7512.c | ||
tifm_7xx1.c | ||
tifm_core.c | ||
tsl2550.c | ||
vexpress-syscfg.c | ||
vmw_balloon.c |