vfio/type1: Catch zero from pin_user_pages_remote()

Alex Williamson · Alex Williamson · commit 4eb4e96b0b98 · 2025-03-31T14:06:52.000-06:00
JIRA: https://issues.redhat.com/browse/RHEL-85587 commit afe84f3 Author: Alex Williamson <alex.williamson@redhat.com> Date: Tue Feb 18 15:22:01 2025 -0700 vfio/type1: Catch zero from pin_user_pages_remote() pin_user_pages_remote() can currently return zero for invalid args or zero nr_pages, neither of which should ever happen. However vaddr_get_pfns() indicates it should only ever return a positive value or -errno and there's a theoretical case where this can slip through and be unhandled by callers. Therefore convert zero to -EFAULT. Reviewed-by: Peter Xu <peterx@redhat.com> Reviewed-by: Mitchell Augustin <mitchell.augustin@canonical.com> Tested-by: Mitchell Augustin <mitchell.augustin@canonical.com> Reviewed-by: Jason Gunthorpe <jgg@nvidia.com> Link: https://lore.kernel.org/r/20250218222209.1382449-2-alex.williamson@redhat.com Signed-off-by: Alex Williamson <alex.williamson@redhat.com> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
@@ -565,6 +565,8 @@ static int vaddr_get_pfns(struct mm_struct *mm, unsigned long vaddr,
 	if (ret > 0) {
 		*pfn = page_to_pfn(pages[0]);
 		goto done;
+	} else if (!ret) {
+		ret = -EFAULT;
 	}
 
 	vaddr = untagged_addr_remote(mm, vaddr);

Original file line number	Diff line number	Diff line change
`@@ -565,6 +565,8 @@ static int vaddr_get_pfns(struct mm_struct *mm, unsigned long vaddr,`
`565`	`565`	`if (ret > 0) {`
`566`	`566`	`*pfn = page_to_pfn(pages[0]);`
`567`	`567`	`goto done;`
	`568`	`+ } else if (!ret) {`
	`569`	`+ ret = -EFAULT;`
`568`	`570`	`}`
`569`	`571`
`570`	`572`	`vaddr = untagged_addr_remote(mm, vaddr);`