Messages in this thread Patch in this message | | | Date | Mon, 11 Oct 2010 11:44:17 +0200 | From | "Michael S. Tsirkin" <> | Subject | [PATCH] dma: fix error handling on out of memory |
| |
get_user_pages might return less pages than requested. If this happens for the first iovec in dma_pin_iovec_pages, then nr_iovecs is 0 and so dma_unpin_iovec_pages will not unpin any pages, leaking pinned memory. A similar off by one would trigger for any of the following entries.
Fix by updating nr_iovecs and nr_pages in this case.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com> ---
Error handling in dma_pin_iovec_pages still looks wrong to me. Am I missing something? The following patch against 2.6.36-rc7 was under some very light testing by me.
Thanks,
drivers/dma/iovlock.c | 8 +++++++- 1 files changed, 7 insertions(+), 1 deletions(-)
diff --git a/drivers/dma/iovlock.c b/drivers/dma/iovlock.c index bb48a57..21ed8f3 100644 --- a/drivers/dma/iovlock.c +++ b/drivers/dma/iovlock.c @@ -107,10 +107,16 @@ struct dma_pinned_list *dma_pin_iovec_pages(struct iovec *iov, size_t len) NULL); up_read(¤t->mm->mmap_sem); - if (ret != page_list->nr_pages) + if (unlikely(ret < 0)) goto unpin; local_list->nr_iovecs = i + 1; + + if (unlikely(ret != page_list->nr_pages)) { + page_list->nr_pages = ret; + goto unpin; + } + } return local_list; -- MST
| |