From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C0F2CDB47E for ; Thu, 19 Oct 2023 02:28:35 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 6323680078; Wed, 18 Oct 2023 22:28:34 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 5E28080074; Wed, 18 Oct 2023 22:28:34 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 4AA0B80078; Wed, 18 Oct 2023 22:28:34 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0010.hostedemail.com [216.40.44.10]) by kanga.kvack.org (Postfix) with ESMTP id 39A3F80074 for ; Wed, 18 Oct 2023 22:28:34 -0400 (EDT) Received: from smtpin12.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay10.hostedemail.com (Postfix) with ESMTP id 85064C0473 for ; Thu, 19 Oct 2023 02:28:33 +0000 (UTC) X-FDA: 81360627306.12.47DFB39 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by imf21.hostedemail.com (Postfix) with ESMTP id B4F811C0005 for ; Thu, 19 Oct 2023 02:28:31 +0000 (UTC) Authentication-Results: imf21.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=DZTAM56G; dmarc=pass (policy=none) header.from=redhat.com; spf=pass (imf21.hostedemail.com: domain of bhe@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=bhe@redhat.com ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1697682511; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type:content-transfer-encoding: in-reply-to:in-reply-to:references:references:dkim-signature; bh=U3e/R8h8CUl6Qt8HzoNg568ab2TdGmvLJ3uBUWajvX8=; b=SaWIxJBmBWGJe6BbuZcDgxhYj2UmHASPomazce/sm4UEnYdqi/7LsNqBT6DsVX73yAS1Ci oJzKTiiCXmKvYOsXVlvPYIuvDPUilWLuKm6+wM4grIi+OrEqkF1qVAnEBDizyJ71M7Wd0R dwFb1XLe+LVEA8vLOWBKFzcO/HvYrio= ARC-Authentication-Results: i=1; imf21.hostedemail.com; dkim=pass header.d=redhat.com header.s=mimecast20190719 header.b=DZTAM56G; dmarc=pass (policy=none) header.from=redhat.com; spf=pass (imf21.hostedemail.com: domain of bhe@redhat.com designates 170.10.133.124 as permitted sender) smtp.mailfrom=bhe@redhat.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1697682511; a=rsa-sha256; cv=none; b=DU73hi08oBGBIM7vBi3hTI/aTAaWGrIto4ExCPfgoiPjwiy0lsyjJ2q+duNrptXvrxxTDa XHbjc/fYJ3b9Hw2J1K1+nuBoxJMPzHkw6J8P18H6BROBJBfWJQsOxD4U9Q5N3d+CKmNF/h 14iWohP2oHTfwnOOgAhIogRzGGDch9I= DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1697682510; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=U3e/R8h8CUl6Qt8HzoNg568ab2TdGmvLJ3uBUWajvX8=; b=DZTAM56Gdexgv0t4aTEJkCTmn0Ir6ABvs1bnLY4Ryw3R5pYWBq9JfJzaoM5t/14WiZ4fRc kDDbuG0j/IR6k9UVCk68MniZ69YRVcj8j6PBngcxCb/Ywm0PPnwD8W93/rYJtO1UQntb10 efLxQCfbMV3aIyj9Rw8rFj8tzOfnUFk= Received: from mimecast-mx02.redhat.com (mx-ext.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-544-Xqo4N_V8NMSwLG0l_9noLA-1; Wed, 18 Oct 2023 22:28:27 -0400 X-MC-Unique: Xqo4N_V8NMSwLG0l_9noLA-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.rdu2.redhat.com [10.11.54.5]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 7FC7D29AA383; Thu, 19 Oct 2023 02:28:26 +0000 (UTC) Received: from localhost (unknown [10.72.112.51]) by smtp.corp.redhat.com (Postfix) with ESMTPS id B79DB503B; Thu, 19 Oct 2023 02:28:25 +0000 (UTC) Date: Thu, 19 Oct 2023 10:28:21 +0800 From: Baoquan He To: Andrew Morton Cc: Dan Carpenter , Philip Li , oe-kbuild@lists.linux.dev, Lorenzo Stoakes , lkp@intel.com, oe-kbuild-all@lists.linux.dev, linux-kernel@vger.kernel.org, Linux Memory Management List Subject: Re: mm/vmalloc.c:3689 vread_iter() error: we previously assumed 'vm' could be null (see line 3667) Message-ID: References: <89caf59a-d3b9-409d-b1ae-9e370cb9ee7d@kadam.mountain> <20231018085248.6f3f36101cbdfe0990c8b467@linux-foundation.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20231018085248.6f3f36101cbdfe0990c8b467@linux-foundation.org> X-Scanned-By: MIMEDefang 3.4.1 on 10.11.54.5 X-Rspam-User: X-Stat-Signature: uihjbir174qygj6gz3wk3z6k1ebm45so X-Rspamd-Server: rspam07 X-Rspamd-Queue-Id: B4F811C0005 X-HE-Tag: 1697682511-490447 X-HE-Meta: U2FsdGVkX18o8Dr+mlyLJUklyvVMheIbjLQBYUiL8mkf0xyXCvwEO2Uuj3Lys3bWcND4uQLeRS9HE+aPvXRJLn/gWOhHU7suUAjqB2trV+OqxXosz7FBIHz6HTQpZHrRKGGvr+YJ8EDJq23meu63LNsg8nRmN5MKj/YvguYI847F9x5HCev5xPzQmUTcQq4GzG7NPmoUQjsm5rr/gDpxXoeN4Xay+2slXMU6yDfiXPTYMzViALNFCWJ12mOagaI8amz3dJDiQUatY+iLKmAYnFQNLDxKLEZhwqsM7v4v4vAt63rcxKg/bhcpCzQlvpBjLeCqEV6JkUdc7YUl9SAJ7wV6e7D26e7xPd8YuUnwadgWVw88ANGK0c/nVXLb2CQzXgNQid9jRn18mivW+kSCDZAp3QIzJF/l2XnmEYFI753AtGMxtoGgAFypTuMb1LMsJ3pRw8ACktYhhBR/irqc54VdVmB58Ov3N5JyVKStoIIwWqBuSbP4R11W1c7tyfwTGObam1fdNI2V6iD/0s1+Yf65YTQCwpcCqn59v7ohdfiCi6vIBwJisw0CklAnwXQoa6QS0mbcWwkQikowuYfZYKpj4ghUBgIxxwGV1fP5O2Re8dTXuy0vzZD7pIsY5lJS8CeeC96NhOEj/DBkWG3dTMhT2X3rH8yncYAT1YJ8J5Gzd9fGacOoabn/AnhnkxZhkYf7Ut4ptXi0lQcSits4I/OuRE0ASUW/vRj83yqspUZ2ocvuHKBlCYV0DhOphysfK4RP+LhGhpN0gT5wdXUitE2ufo/C4ykm4WSrQYOB+K24+47T/derSNjDDfHDWwOM9VLzbx/scIiwfqcM0pCKOpo7UOjUH0O4+cZlqKThJvND1ESxsxTUhhFa1znkzTgVCJmNygUpQYE9JDESHkHMF9US8eySDuj6O2LDL8y40FPTGtUsxbq3xKlPrLBrHAgO/fEvob7/YH2e0tvukdL CrTwutOx 15UeXXfRWwsFV1D9+TegdQwKmDXfey4sg9gNfoJ8NUywDu5InaELw+uGTNt+CPOxLqGjSWV/XrEGc7NURIF/p0KIQz7CNtiZJn7dLPX87uio/JWBlP4oDBe3RgxW9UQ8TWX11w14ucLTndPuXdu70dzOiH79wnyDBA3KCBNpy3n3Wz5/GIsNtQ7jM+v7P//WeKVwkw6BtAFftd+vRKxByBD/yk3C1OOu+eBjXlKrysrCvnZB6YoULhMKvSEngzvKbMcZHRp/ClZHvD+Rq2co9XTnbaOCXH6wmMig+bFD9PwWhmQkj+n2xyvZa1e3CgB1gc9M5DGL3SfYF9cHVzD5YV3E6ZdF9ZEvO0RglQOZOMkffGYcyE/AE6MGelMnm5OwH9bii1NiQ00vHTB7BinqoQdFp72XCkUl0GYMd X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On 10/18/23 at 08:52am, Andrew Morton wrote: > On Wed, 18 Oct 2023 23:15:31 +0800 Baoquan He wrote: > > > From: Baoquan He > > Date: Wed, 18 Oct 2023 22:50:14 +0800 > > Subject: [PATCH] mm/vmalloc: fix the unchecked dereference warning in vread_iter() > > Content-type: text/plain > > > > LKP reported smatch warning as below: > > > > =================== > > smatch warnings: > > mm/vmalloc.c:3689 vread_iter() error: we previously assumed 'vm' could be null (see line 3667) > > ...... > > 06c8994626d1b7 @3667 size = vm ? get_vm_area_size(vm) : va_size(va); > > ...... > > 06c8994626d1b7 @3689 else if (!(vm->flags & VM_IOREMAP)) > > ^^^^^^^^^ > > Unchecked dereference > > ===================== > > > > So add checking on whether 'vm' is not null when dereferencing it in > > vread_iter(). This mutes smatch complaint. > > > > ... > > > > --- a/mm/vmalloc.c > > +++ b/mm/vmalloc.c > > @@ -3813,7 +3813,7 @@ long vread_iter(struct iov_iter *iter, const char *addr, size_t count) > > > > if (flags & VMAP_RAM) > > copied = vmap_ram_vread_iter(iter, addr, n, flags); > > - else if (!(vm->flags & VM_IOREMAP)) > > + else if (!(vm && (vm->flags & VM_IOREMAP))) > > copied = aligned_vread_iter(iter, addr, n); > > else /* IOREMAP area is treated as memory hole */ > > copied = zero_iter(iter, n); > > So is this not a real runtime bug? We're only doing this to suppress a > smatch warning? > > If so, can we please include a description of *why* this wasn't a bug? > What conditions ensure that vm!=NULL at this point? I think this is not a real runtime bug. The only chance it can hapen is when (flags == VMAP_BLOCK) is true. That has been warned and could never happen. I updated patch log and paste v2 here. /* * VMAP_BLOCK indicates a sub-type of vm_map_ram area, need * be set together with VMAP_RAM. */ WARN_ON(flags == VMAP_BLOCK); if (!vm && !flags) continue; >From 89cc02302766ab7a67cc668390c24079b4a9406b Mon Sep 17 00:00:00 2001 From: Baoquan He Date: Wed, 18 Oct 2023 22:50:14 +0800 Subject: [PATCH v2] mm/vmalloc: fix the unchecked dereference warning in vread_iter() Content-type: text/plain LKP reported smatch warning as below: =================== smatch warnings: mm/vmalloc.c:3689 vread_iter() error: we previously assumed 'vm' could be null (see line 3667) ...... 06c8994626d1b7 @3667 size = vm ? get_vm_area_size(vm) : va_size(va); ...... 06c8994626d1b7 @3689 else if (!(vm->flags & VM_IOREMAP)) ^^^^^^^^^ Unchecked dereference ===================== This is not a real-time bug because the possible null 'vm' in the pointed place could only happen when flags == VMAP_BLOCK. However, the case 'flags == VMAP_BLOCK' should never happen and has been detected with WARN_ON. Please check vm_map_ram() implementation and the earlier checking in vread_iter() at below: ~~~~~~~~~~~~~~~~~~~~~~~~~~ /* * VMAP_BLOCK indicates a sub-type of vm_map_ram area, need * be set together with VMAP_RAM. */ WARN_ON(flags == VMAP_BLOCK); if (!vm && !flags) continue; ~~~~~~~~~~~~~~~~~~~~~~~~~~ So add checking on whether 'vm' could be null when dereferencing it in vread_iter(). This mutes smatch complaint. Reported-by: kernel test robot Reported-by: Dan Carpenter Closes: https://lore.kernel.org/r/202310171600.WCrsOwFj-lkp@intel.com/ Signed-off-by: Baoquan He --- v1->v2: - Update patch log to state that it's not a realtime bug as Andrew suggested. mm/vmalloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/mm/vmalloc.c b/mm/vmalloc.c index aad48ed8d86b..2cc992392db7 100644 --- a/mm/vmalloc.c +++ b/mm/vmalloc.c @@ -3813,7 +3813,7 @@ long vread_iter(struct iov_iter *iter, const char *addr, size_t count) if (flags & VMAP_RAM) copied = vmap_ram_vread_iter(iter, addr, n, flags); - else if (!(vm->flags & VM_IOREMAP)) + else if (!(vm && (vm->flags & VM_IOREMAP))) copied = aligned_vread_iter(iter, addr, n); else /* IOREMAP area is treated as memory hole */ copied = zero_iter(iter, n); -- 2.41.0