[PATCH] VMCI: check return value of get_user_pages_fast() for errors

[Alex Dewar]

In a couple of places in qp_host_get_user_memory(),
get_user_pages_fast() is called without properly checking for errors. If
e.g. -EFAULT is returned, this negative value will then be passed on to
qp_release_pages(), which expects a u64 as input.

Fix this by only calling qp_release_pages() when we have a positive
number returned.

Fixes: 06164d2b72aa ("VMCI: queue pairs implementation.")
Signed-off-by: Alex Dewar <alex.dewa...@gmail.com>
---
 drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/misc/vmw_vmci/vmci_queue_pair.c 
b/drivers/misc/vmw_vmci/vmci_queue_pair.c
index 8531ae781195..c49065887e8f 100644
--- a/drivers/misc/vmw_vmci/vmci_queue_pair.c
+++ b/drivers/misc/vmw_vmci/vmci_queue_pair.c
@@ -657,8 +657,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
        if (retval < (int)produce_q->kernel_if->num_pages) {
                pr_debug("get_user_pages_fast(produce) failed (retval=%d)",
                        retval);
-               qp_release_pages(produce_q->kernel_if->u.h.header_page,
-                                retval, false);
+               if (retval > 0)
+                       qp_release_pages(produce_q->kernel_if->u.h.header_page,
+                                       retval, false);
                err = VMCI_ERROR_NO_MEM;
                goto out;
        }
@@ -670,8 +671,9 @@ static int qp_host_get_user_memory(u64 produce_uva,
        if (retval < (int)consume_q->kernel_if->num_pages) {
                pr_debug("get_user_pages_fast(consume) failed (retval=%d)",
                        retval);
-               qp_release_pages(consume_q->kernel_if->u.h.header_page,
-                                retval, false);
+               if (retval > 0)
+                       qp_release_pages(consume_q->kernel_if->u.h.header_page,
+                                       retval, false);
                qp_release_pages(produce_q->kernel_if->u.h.header_page,
                                 produce_q->kernel_if->num_pages, false);
                err = VMCI_ERROR_NO_MEM;
-- 
2.28.0