fa63f083b3
rio_dma_transfer() attempts to clamp the return value of
pin_user_pages_fast() to be >= 0. However, the attempt fails because
nr_pages is overridden a few lines later, and restored to the undesirable
-ERRNO value.
The return value is ultimately stored in nr_pages, which in turn is passed
to unpin_user_pages(), which expects nr_pages >= 0, else, disaster.
Fix this by fixing the nesting of the assignment to nr_pages: nr_pages
should be clamped to zero if pin_user_pages_fast() returns -ERRNO, or set
to the return value of pin_user_pages_fast(), otherwise.
[jhubbard@nvidia.com: new changelog]
Fixes:
|
||
|---|---|---|
| .. | ||
| devices | ||
| switches | ||
| Kconfig | ||
| Makefile | ||
| rio_cm.c | ||
| rio-access.c | ||
| rio-driver.c | ||
| rio-scan.c | ||
| rio-sysfs.c | ||
| rio.c | ||
| rio.h | ||