From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ot1-f50.google.com (mail-ot1-f50.google.com [209.85.210.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2B833AA514 for ; Thu, 9 Apr 2026 09:12:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775725938; cv=none; b=P03lCqTwrcBOJwr+76DI0VO4ZcBV/COAUJzZ+1n4gdj1z2rhkugdumegZUtMTJMbN81EU1tE0wUY4jfqvlaVWnvtcTBmvvm0tnXGMbh0PWqlAEJyMu7KZ8crUcpch9XQHVmTy8oIG/1v9uTqI6Erj4fnanRHELDUUDyV/VU/2DE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775725938; c=relaxed/simple; bh=bel4ovVWOw6s7lJavRV2NK465coWeJPfcm+s9okQ+rw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=dKlB35SdIiq589mRKkZiUCwOJdIWZX0Y6kOJYHeuaHg2UgHyYCUqQ3kDXfqnpcRzE0bndyCvtSzNbpxCO7F8MtSW1dHggAq3etnR21/PGq0smgXs7nQby5HxnnqY2hq3D5H5I4lPbDC8ACuKk2VE5CCcXO5FtAXp+DzJ/bS3Q/M= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=neuling.org; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=j9CzjxYX; arc=none smtp.client-ip=209.85.210.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=neuling.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="j9CzjxYX" Received: by mail-ot1-f50.google.com with SMTP id 46e09a7af769-7dbd1458a77so486339a34.2 for ; Thu, 09 Apr 2026 02:12:12 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1775725931; x=1776330731; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:from:to:cc:subject:date :message-id:reply-to; bh=dBV+/zzkdPHLgFysmifTqJCsNQYHfiRTnr5GUqLTC5E=; b=j9CzjxYXenOkrnzWPZ8o1a8rQtx5Cq0i9dGCXbmviKYi4FiW8wr0JAZyXsfALqh0Pv e/yRvVimQpRCQgG2hbcP/qJrriFHp+3hnVdWYzbdRXf3mWDuOs8+IOMMuxlFTvyIVIJV 0kv4nI1Yo4SGBlmx+3x4/n/ReKrh2Gez5whYenj+3WvRfowK50g1ntvNySj7yq7c0ZBc CiGC3m/iaH0rDLjLKD7B2RN38GRZ1RCTlWw3vw0ZvsM019FmSgZlcwRSktrdaOAqJkY4 sjrAj6z4Yk4j+u2v9NYbW+/zBFuR8uRe9gXB4lEYk2TVYLGWDCN3wyYmzrpd3fBw+a39 zYmw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1775725931; x=1776330731; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=dBV+/zzkdPHLgFysmifTqJCsNQYHfiRTnr5GUqLTC5E=; b=ciUodk9DpQupwiIDn7qcT1MtpgmEIwcY7TXRQFNqCVXVhD4uq3VcK4AhfArdDvmYYB b5BOVEkkmpZtMyddQN+IrXqNwemyEigbLEHdVs2yIUtvoMdylgoN07mnngTxrY5Z3CEr Vta5eLKTK6490pRWTsj9VaZoLCOVzrO2WuD8MUVmYvHw1ZKmd7YqIEXSsTUVL8c0vNkK L5qW6t+WvTe4go63so7tBcY4xnK8MLpMFycrKq1K5TYRP0MmduR4KCDAknC+FdeU80px PLLPx58w/7EF7QNMuKGCMMOYVZgCffMcW7FLU/zPndP62brr0Qf8lPJKaM+ZVWbCpV2l p/vA== X-Forwarded-Encrypted: i=1; AJvYcCU62tDT2PPl89lglwLv0h0w6tiFBegSjEAWeI8fYlZudZCqHHj7keT4Mp8hcGX7NRrsbh8u8IAnvIx4DEM=@vger.kernel.org X-Gm-Message-State: AOJu0Yw8DuOTUpWh09fXHxB1wnZ8uOFCOE9PxxHTrGiX8Ia7bTjMBmSr 7FxZnSIq7NOT91mvP/dNgYyO4uNv67QFUSsjbk6ozgI3QDvPMohdzf3F X-Gm-Gg: AeBDievumSpvXVp6z4m0wLx9RaV6jdn0qmMg1X+Ac78giboot105SjUmZ9pui31+j8g 8DhqflMS/Dem1eWv97TbjaILTN1ydjHzI2ssitMcLf7KfphkoGDyVRM7xPFzQ0kKDv4kleMB9gI iTB9bt+0hCVWABex21NzYjR8ujd9iqbLV4ncBVyxBjIXSxDoM+gL+szDb9reZZ1lKADd+IoFhG5 lINxhOCpwvctfINKSHVIYu8f4XB7zK5tRTXAe90jjEFA8pPaIsj5aErdL2T3tE5yqJ6Na6yPJ9X lBkqdyJuvyU32baiPv40W4iRGRh7gafllOF0X+hVTqaJX3kh7RYS01OcO6FMoylEPo/upTn2NP2 ij3u5Hyo6Dro15g0NRk1CHK3xzKpzHfXAkGWtZh7s8B+4M1KOv+6JjHtN29DYWV97bpSvc1UwOM ZTRPw8FJBcnvGwfqXN2QAjphq9nJPgZsTSmQ== X-Received: by 2002:a05:6830:2546:b0:7d7:fada:89ca with SMTP id 46e09a7af769-7dbb70cf2aemr15358771a34.15.1775725930696; Thu, 09 Apr 2026 02:12:10 -0700 (PDT) Received: from ird-aus2.tenstorrent.com ([38.104.49.66]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7dba7184e14sm15585364a34.11.2026.04.09.02.12.09 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 09 Apr 2026 02:12:10 -0700 (PDT) Sender: Michael Neuling From: Michael Neuling To: =?UTF-8?q?Bj=C3=B6rn=20T=C3=B6pel?= , "Mike Rapoport (Microsoft)" , "Vishal Moola (Oracle)" , Albert Ou , Aleksa Paunovic , Aleksandar Rikalo , Alexandre Ghiti , Andrew Jones , Andrew Morton , Arnd Bergmann , David Hildenbrand , Djordje Todorovic , Guo Ren , Junhui Liu , Kevin Brodsky , Lorenzo Stoakes , Nam Cao , Oleg Nesterov , Oscar Salvador , Palmer Dabbelt , Paul Walmsley , Qinglin Pan , Raj Vishwanathan4 , linux-kernel@vger.kernel.org, linux-riscv@lists.infradead.org Cc: Michael Neuling Subject: [PATCH 4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions Date: Thu, 9 Apr 2026 09:11:42 +0000 Message-ID: <20260409091143.1348853-5-mikey@neuling.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260409091143.1348853-1-mikey@neuling.org> References: <20260409091143.1348853-1-mikey@neuling.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit huge_pte_offset() can return NULL when any level of the page table walk encounters a non-present entry. Both huge_ptep_set_access_flags() and huge_ptep_set_wrprotect() re-derive ptep via huge_pte_offset() in the napot path but use the result without a NULL check, leading to NULL pointer dereferences in get_clear_contig_flush() and set_pte_at(). Add NULL checks after huge_pte_offset() in both functions. Fixes: 82a1a1f3bf ("riscv: mm: support Svnapot in hugetlb page") Signed-off-by: Michael Neuling Assisted-by: Cursor:claude-4.6-opus-high-thinking --- arch/riscv/mm/hugetlbpage.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/riscv/mm/hugetlbpage.c b/arch/riscv/mm/hugetlbpage.c index a6d217112c..7d155341cf 100644 --- a/arch/riscv/mm/hugetlbpage.c +++ b/arch/riscv/mm/hugetlbpage.c @@ -288,6 +288,8 @@ int huge_ptep_set_access_flags(struct vm_area_struct *vma, order = napot_cont_order(pte); pte_num = napot_pte_num(order); ptep = huge_pte_offset(mm, addr, napot_cont_size(order)); + if (!ptep) + return 0; orig_pte = get_clear_contig_flush(mm, addr, ptep, pte_num); if (pte_dirty(orig_pte)) @@ -335,6 +337,8 @@ void huge_ptep_set_wrprotect(struct mm_struct *mm, order = napot_cont_order(pte); pte_num = napot_pte_num(order); ptep = huge_pte_offset(mm, addr, napot_cont_size(order)); + if (!ptep) + return; orig_pte = get_clear_contig_flush(mm, addr, ptep, pte_num); orig_pte = pte_wrprotect(orig_pte); -- 2.43.0