lkml.org 
[lkml]   [2023]   [Oct]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: mm/vmalloc.c:3689 vread_iter() error: we previously assumed 'vm' could be null (see line 3667)
On 10/18/23 at 08:45pm, Philip Li wrote:
> On Wed, Oct 18, 2023 at 08:12:30PM +0800, Baoquan He wrote:
> > Hi Dan,
> >
> > On 10/18/23 at 01:32pm, Dan Carpenter wrote:
> > > On Wed, Oct 18, 2023 at 04:54:33PM +0800, Baoquan He wrote:
> > > > Hi,
> > > >
> > > > On 10/17/23 at 05:26pm, Dan Carpenter wrote:
> > > > > tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> > > > > head: 213f891525c222e8ed145ce1ce7ae1f47921cb9c
> > > > > commit: 4c91c07c93bbbdd7f2d9de2beb7ee5c2a48ad8e7 mm: vmalloc: convert vread() to vread_iter()
> > > > > config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20231017/202310171600.WCrsOwFj-lkp@intel.com/config)
> > > > > compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
> > > > > reproduce: (https://download.01.org/0day-ci/archive/20231017/202310171600.WCrsOwFj-lkp@intel.com/reproduce)
> > > > >
> > > > > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > > > > the same patch/commit), kindly add following tags
> > > > > | Reported-by: kernel test robot <lkp@intel.com>
> > > > > | Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> > > > > | Closes: https://lore.kernel.org/r/202310171600.WCrsOwFj-lkp@intel.com/
> > > > >
> > > > > smatch warnings:
> > > > > mm/vmalloc.c:3689 vread_iter() error: we previously assumed 'vm' could be null (see line 3667)
> > > >
> > > > I see the code deficit, while the reproduce link seems to be unavilable.
> > > > Could you double check the link and provide a good one so that I can
> > > > verify the code fix?
> > >
> > > Here's a link. :)
> > >
> > > https://repo.or.cz/smatch.git/blob/HEAD:/Documentation/smatch.txt
> > >
> > > Just build it and run:
> > >
> > > ~/smatch/smatch_scripts/kchecker drivers/whatever/file.c
> >
> > I don't know smatch and lkp well, and have no idea on how to use above
>
> Hi Baoquan, sorry there's issue in the generation of reproduce step, but even
> it is generated, it doesn't contain the detail to setup smatch. You can follow
> the smatch.txt to do the setup.
>
> > smatch.txt to build the target file.c. I meant in this lkp report, the
> > config file is available, however, the reproduce file is empty. Could
> > you help add an available reproduce file link? or give a little more
> > detail guiding me how to make use of above smatch file to build .c file?
>
> On the other side, Dan has added analysis to the report as below.
> It's possible to resolve the issue without running the smatch check.
> You can give this a try.
>
> 06c8994626d1b7 Baoquan He 2023-02-06 3657 if (!vm && !flags)
>
> NULL check
>
> ...
>
> 06c8994626d1b7 Baoquan He 2023-02-06 @3689 else if (!(vm->flags & VM_IOREMAP))
> ^^^^^^^^^
> Unchecked dereference

Thanks for the detailed explanation, Philipp.

Yes, the code deficit is identified. I planned to reproduce and verify
with LKP's reproducer so that it's 100% clear. Anyway, below patch
should fix it.


From a39fdd50030a7d88a7f69bcba29e6f75020a1915 Mon Sep 17 00:00:00 2001
From: Baoquan He <bhe@redhat.com>
Date: Wed, 18 Oct 2023 22:50:14 +0800
Subject: [PATCH] mm/vmalloc: fix the unchecked dereference warning in vread_iter()
Content-type: text/plain

LKP reported smatch warning as below:

===================
smatch warnings:
mm/vmalloc.c:3689 vread_iter() error: we previously assumed 'vm' could be null (see line 3667)
......
06c8994626d1b7 @3667 size = vm ? get_vm_area_size(vm) : va_size(va);
......
06c8994626d1b7 @3689 else if (!(vm->flags & VM_IOREMAP))
^^^^^^^^^
Unchecked dereference
=====================

So add checking on whether 'vm' is not null when dereferencing it in
vread_iter(). This mutes smatch complaint.

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202310171600.WCrsOwFj-lkp@intel.com/
Signed-off-by: Baoquan He <bhe@redhat.com>
---
mm/vmalloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index aad48ed8d86b..2cc992392db7 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -3813,7 +3813,7 @@ long vread_iter(struct iov_iter *iter, const char *addr, size_t count)

if (flags & VMAP_RAM)
copied = vmap_ram_vread_iter(iter, addr, n, flags);
- else if (!(vm->flags & VM_IOREMAP))
+ else if (!(vm && (vm->flags & VM_IOREMAP)))
copied = aligned_vread_iter(iter, addr, n);
else /* IOREMAP area is treated as memory hole */
copied = zero_iter(iter, n);
--
2.41.0
\
 
 \ /
  Last update: 2023-10-18 17:17    [W:0.101 / U:1.804 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site