diff options
author | Al Viro <viro@zeniv.linux.org.uk> | 2014-02-02 07:05:05 -0500 |
---|---|---|
committer | Al Viro <viro@zeniv.linux.org.uk> | 2014-02-09 15:21:16 -0500 |
commit | c9efe51165fa0aff57be54e3cb0201ac87f68980 (patch) | |
tree | 2c956f57a8c176d0df62a16adc33a2d31b78a929 | |
parent | d311d79de305f1ada47cadd672e6ed1b28a949eb (diff) |
fix a kmap leak in virtio_console
While we are at it, don't do kmap() under kmap_atomic(), *especially*
for a page we'd allocated with GFP_KERNEL. It's spelled "page_address",
and had that been more than that, we'd have a real trouble - kmap_high()
can block, and doing that while holding kmap_atomic() is a Bad Idea(tm).
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
-rw-r--r-- | drivers/char/virtio_console.c | 9 |
1 files changed, 3 insertions, 6 deletions
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index feea87cc6b8f..6928d094451d 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c | |||
@@ -890,12 +890,10 @@ static int pipe_to_sg(struct pipe_inode_info *pipe, struct pipe_buffer *buf, | |||
890 | } else { | 890 | } else { |
891 | /* Failback to copying a page */ | 891 | /* Failback to copying a page */ |
892 | struct page *page = alloc_page(GFP_KERNEL); | 892 | struct page *page = alloc_page(GFP_KERNEL); |
893 | char *src = buf->ops->map(pipe, buf, 1); | 893 | char *src; |
894 | char *dst; | ||
895 | 894 | ||
896 | if (!page) | 895 | if (!page) |
897 | return -ENOMEM; | 896 | return -ENOMEM; |
898 | dst = kmap(page); | ||
899 | 897 | ||
900 | offset = sd->pos & ~PAGE_MASK; | 898 | offset = sd->pos & ~PAGE_MASK; |
901 | 899 | ||
@@ -903,9 +901,8 @@ static int pipe_to_sg(struct pipe_inode_info *pipe, struct pipe_buffer *buf, | |||
903 | if (len + offset > PAGE_SIZE) | 901 | if (len + offset > PAGE_SIZE) |
904 | len = PAGE_SIZE - offset; | 902 | len = PAGE_SIZE - offset; |
905 | 903 | ||
906 | memcpy(dst + offset, src + buf->offset, len); | 904 | src = buf->ops->map(pipe, buf, 1); |
907 | 905 | memcpy(page_address(page) + offset, src + buf->offset, len); | |
908 | kunmap(page); | ||
909 | buf->ops->unmap(pipe, buf, src); | 906 | buf->ops->unmap(pipe, buf, src); |
910 | 907 | ||
911 | sg_set_page(&(sgl->sg[sgl->n]), page, len, offset); | 908 | sg_set_page(&(sgl->sg[sgl->n]), page, len, offset); |