lib: free pagelist on error in iov_iter_extract_pages()#811
lib: free pagelist on error in iov_iter_extract_pages()#811blktests-ci[bot] wants to merge 1 commit into
Conversation
|
Upstream branch: 6d35786 |
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
1f0d33a to
b1870f6
Compare
|
Upstream branch: aa54b1d |
blktests-ci
Bot
force-pushed
the
series/1091577=>linus-master
branch
from
e50d94a to
79d1ac7
Compare
|
Upstream branch: aa54b1d |
blktests-ci
Bot
force-pushed
the
series/1091577=>linus-master
branch
from
79d1ac7 to
6917f08
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
b1870f6 to
ca57796
Compare
|
Upstream branch: 70eda68 |
blktests-ci
Bot
force-pushed
the
series/1091577=>linus-master
branch
from
6917f08 to
89768ce
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
ca57796 to
c1feb59
Compare
|
Upstream branch: 8bc67e4 |
blktests-ci
Bot
force-pushed
the
series/1091577=>linus-master
branch
from
89768ce to
93cb581
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
c1feb59 to
ea833a1
Compare
|
Upstream branch: 6779b50 |
blktests-ci
Bot
force-pushed
the
series/1091577=>linus-master
branch
from
93cb581 to
2a51bbb
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
ea833a1 to
7af85d1
Compare
|
Upstream branch: 79bd2dd |
blktests-ci
Bot
force-pushed
the
series/1091577=>linus-master
branch
from
2a51bbb to
6d4fca7
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
7af85d1 to
de94ac7
Compare
|
Upstream branch: eed108e |
blktests-ci
Bot
force-pushed
the
series/1091577=>linus-master
branch
from
6d4fca7 to
b054898
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
de94ac7 to
86d8d37
Compare
|
Upstream branch: e8c2f9f |
blktests-ci
Bot
force-pushed
the
series/1091577=>linus-master
branch
from
b054898 to
a9d90e2
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
86d8d37 to
9805659
Compare
|
Upstream branch: eb3f4b7 |
blktests-ci
Bot
force-pushed
the
series/1091577=>linus-master
branch
from
a9d90e2 to
5780d4e
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
9805659 to
3f4a345
Compare
|
Upstream branch: 8fde5d1 |
blktests-ci
Bot
force-pushed
the
series/1091577=>linus-master
branch
from
5780d4e to
4dcb14c
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
3f4a345 to
c6dc343
Compare
|
Upstream branch: e43ffb6 |
blktests-ci
Bot
force-pushed
the
series/1091577=>linus-master
branch
from
4dcb14c to
55df0a9
Compare
blktests-ci
Bot
force-pushed
the
linus-master_base
branch
from
c6dc343 to
fc36596
Compare
|
Upstream branch: ba3e43a |
Users of 'iov_iter_extract_pages()' may provide small, likely
stack-allocated, array of pages by itself and then reject to
use it if it's considered too small. In such a case, passing
NULL pointer means that 'iov_iter_extract_pages()' should
allocate array of pages internally (via 'want_pages_array()').
An overall scenario may be:
...
struct page *stack_pages[SMALL];
struct page **pages = stack_pages;
...
if (not_enough_pages(SMALL))
pages = NULL;
...
if (iov_iter_extract_pages(..., &pages, ...) <= 0) {
/* Even in case of error, new array of pages may be allocated */
if (pages != stack_pages)
kvfree(pages); [1]
/* The rest of error handling and return */
}
/* Regular flow */
...
if (pages != stack_pages)
kvfree(pages);
...
That is, if you're unlucky so SMALL amount of pages wasn't enough and
new array of pages was allocated, missing [1] causes the memory leak.
Currently 'bio_integrity_map_user()' seems the only place where such
a leak looks possible. Older kernels may have more. In particular,
6.12.x has this type of leak in 'bio_map_user_iov()', and it was
found with syzkaller and reproduced experimentally.
So adjust 'iov_iter_extract_pages()' to make cleanup [1] itself rather
than rely on caller's handling on error paths.
Fixes: 7d58fe7 ("iov_iter: Add a function to extract a page list from an iterator")
Cc: stable@vger.kernel.org
Suggested-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
blktests-ci
Bot
force-pushed
the
series/1091577=>linus-master
branch
from
55df0a9 to
d190837
Compare
1 participant
Pull request for series with
subject: lib: free pagelist on error in iov_iter_extract_pages()
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=1091577