From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1753773AbdDKV0i (ORCPT <rfc822;w@1wt.eu>);
        Tue, 11 Apr 2017 17:26:38 -0400
Received: from mail.linuxfoundation.org ([140.211.169.12]:38724 "EHLO
        mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751020AbdDKV0f (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Tue, 11 Apr 2017 17:26:35 -0400
Date: Tue, 11 Apr 2017 14:26:33 -0700
From: Andrew Morton <akpm@linux-foundation.org>
To: Colin King <colin.king@canonical.com>
Cc: Vlastimil Babka <vbabka@suse.cz>, Minchan Kim <minchan@kernel.org>,
        Mel Gorman <mgorman@techsingularity.net>,
        Johannes Weiner <hannes@cmpxchg.org>,
        =?ISO-8859-1?Q?J=E9r=F4me?= Glisse <jglisse@redhat.com>,
        "Kirill A . Shutemov" <kirill.shutemov@linux.intel.com>,
        linux-mm@kvack.org, kernel-janitors@vger.kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH] mm/migrate: check for null vma before dereferencing it
Message-Id: <20170411142633.d01ba0aaeb3e6075d517208c@linux-foundation.org>
In-Reply-To: <20170411125102.19497-1-colin.king@canonical.com>
References: <20170411125102.19497-1-colin.king@canonical.com>
X-Mailer: Sylpheed 3.4.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, 11 Apr 2017 13:51:02 +0100 Colin King <colin.king@canonical.com> wrote:

> From: Colin Ian King <colin.king@canonical.com>
> 
> check if vma is null before dereferencing it, this avoiding any
> potential null pointer dereferences on vma via the is_vm_hugetlb_page
> call or the direct vma->vm_flags reference.
> 
> Detected with CoverityScan, CID#1427995 ("Dereference before null check")
> 
> ...
>
> --- a/mm/migrate.c
> +++ b/mm/migrate.c
> @@ -2757,10 +2757,10 @@ int migrate_vma(const struct migrate_vma_ops *ops,
>  	/* Sanity check the arguments */
>  	start &= PAGE_MASK;
>  	end &= PAGE_MASK;
> -	if (is_vm_hugetlb_page(vma) || (vma->vm_flags & VM_SPECIAL))
> -		return -EINVAL;
>  	if (!vma || !ops || !src || !dst || start >= end)
>  		return -EINVAL;
> +	if (is_vm_hugetlb_page(vma) || (vma->vm_flags & VM_SPECIAL))
> +		return -EINVAL;
>  	if (start < vma->vm_start || start >= vma->vm_end)
>  		return -EINVAL;
>  	if (end <= vma->vm_start || end > vma->vm_end)

I don't know what kernel version this is against but I don't think it's
anything recent?