From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2FE95399CF0 for ; Wed, 26 Aug 2026 07:49:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787730599; cv=none; b=AkV5QvF7u6jHwjIbH8DN+K4z2R5pz17+xss+ry0dZQE9sSfmBKrXXePSsOAsaVYAl/TmOF3C1E4BSOrNwls9igWAGq/kkvuictHWBaElIi1m0teTFV9TXqIL5Upr4/taYRR01R9h3ePfIicxmdYCIb7eai84Hzew4n7FaNAwvbE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787730599; c=relaxed/simple; bh=JlRHHm0eNSQ9jklBNNs6uS42XrK/ONvc2q2ZO0JAXKM=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=fU8eST3YRU8ONNe1KWLVC1MXJAwzdNOxdb+FLzUcHmsiEspBj8mxfgQ0AXhEf76q9b8nCrEYDVWzimkDaFjB1FaBiV2vU565lVv1zaN9iyZjXx3JIcsk8UFHBRUWUcIBEOFdOgqhJLtld/l83KSdiDQTgu09ObrpDVUc6arf/O4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=NT9RDS3I; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="NT9RDS3I" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 181821F000E9; Wed, 26 Aug 2026 07:49:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787730597; bh=31F2mnvxq2qWqjVX4eHj0SWEUOHU/pDwGd4gxco3vwk=; h=Date:Subject:To:Cc:References:From:In-Reply-To; b=NT9RDS3ImUoPGQIptssHDPPOYnlqTeTk5eiSTWked48RFRjYMoCGCTbTDz/Wpzso0 YLEiAdczW3Cd/y1baDAFXECatnMq9bDxdm8sfwnas+mKhbhR0rBeBrIDseo4PE6k6d 9wH6k35Q+kZ28j2zCIHP1uF5wno69VY1esWngoy1WIOa2xCVtlLURrs6xzACzO5gs1 wEmuA2sSle4f22exHzxXYzkscHjy8WLxmjkPE7LM5iF6TuAHtNOXolJ4dJPimt4diO YBg2e+rxFWtVSK17Ng/kY6z5yCkl1MZPcli8EJKFFaN3BDNKtWgQZL6lzfLYj0aOeH /atyhy1MxhuuA== Message-ID: Date: Wed, 26 Aug 2026 09:49:52 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] mm/gup: add NULL check for unlocked parameter in fixup_user_fault() To: Liu Dalin , Andrew Morton , Jason Gunthorpe Cc: John Hubbard , Peter Xu , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Deng Yingchao , Qin Yungao , Luo Qiu References: <6D25DBDC7BEC853D+20260826063124.3255387-1-liudalin@kylinsec.com.cn> From: "David Hildenbrand (Arm)" Content-Language: en-US Autocrypt: addr=david@kernel.org; keydata= xsFNBFXLn5EBEAC+zYvAFJxCBY9Tr1xZgcESmxVNI/0ffzE/ZQOiHJl6mGkmA1R7/uUpiCjJ dBrn+lhhOYjjNefFQou6478faXE6o2AhmebqT4KiQoUQFV4R7y1KMEKoSyy8hQaK1umALTdL QZLQMzNE74ap+GDK0wnacPQFpcG1AE9RMq3aeErY5tujekBS32jfC/7AnH7I0v1v1TbbK3Gp XNeiN4QroO+5qaSr0ID2sz5jtBLRb15RMre27E1ImpaIv2Jw8NJgW0k/D1RyKCwaTsgRdwuK Kx/Y91XuSBdz0uOyU/S8kM1+ag0wvsGlpBVxRR/xw/E8M7TEwuCZQArqqTCmkG6HGcXFT0V9 PXFNNgV5jXMQRwU0O/ztJIQqsE5LsUomE//bLwzj9IVsaQpKDqW6TAPjcdBDPLHvriq7kGjt WhVhdl0qEYB8lkBEU7V2Yb+SYhmhpDrti9Fq1EsmhiHSkxJcGREoMK/63r9WLZYI3+4W2rAc UucZa4OT27U5ZISjNg3Ev0rxU5UH2/pT4wJCfxwocmqaRr6UYmrtZmND89X0KigoFD/XSeVv jwBRNjPAubK9/k5NoRrYqztM9W6sJqrH8+UWZ1Idd/DdmogJh0gNC0+N42Za9yBRURfIdKSb B3JfpUqcWwE7vUaYrHG1nw54pLUoPG6sAA7Mehl3nd4pZUALHwARAQABzS5EYXZpZCBIaWxk ZW5icmFuZCAoQ3VycmVudCkgPGRhdmlkQGtlcm5lbC5vcmc+wsGQBBMBCAA6AhsDBQkmWAik AgsJBBUKCQgCFgICHgUCF4AWIQQb2cqtc1xMOkYN/MpN3hD3AP+DWgUCaYJt/AIZAQAKCRBN 3hD3AP+DWriiD/9BLGEKG+N8L2AXhikJg6YmXom9ytRwPqDgpHpVg2xdhopoWdMRXjzOrIKD g4LSnFaKneQD0hZhoArEeamG5tyo32xoRsPwkbpIzL0OKSZ8G6mVbFGpjmyDLQCAxteXCLXz ZI0VbsuJKelYnKcXWOIndOrNRvE5eoOfTt2XfBnAapxMYY2IsV+qaUXlO63GgfIOg8RBaj7x 3NxkI3rV0SHhI4GU9K6jCvGghxeS1QX6L/XI9mfAYaIwGy5B68kF26piAVYv/QZDEVIpo3t7 /fjSpxKT8plJH6rhhR0epy8dWRHk3qT5tk2P85twasdloWtkMZ7FsCJRKWscm1BLpsDn6EQ4 jeMHECiY9kGKKi8dQpv3FRyo2QApZ49NNDbwcR0ZndK0XFo15iH708H5Qja/8TuXCwnPWAcJ DQoNIDFyaxe26Rx3ZwUkRALa3iPcVjE0//TrQ4KnFf+lMBSrS33xDDBfevW9+Dk6IISmDH1R HFq2jpkN+FX/PE8eVhV68B2DsAPZ5rUwyCKUXPTJ/irrCCmAAb5Jpv11S7hUSpqtM/6oVESC 3z/7CzrVtRODzLtNgV4r5EI+wAv/3PgJLlMwgJM90Fb3CB2IgbxhjvmB1WNdvXACVydx55V7 LPPKodSTF29rlnQAf9HLgCphuuSrrPn5VQDaYZl4N/7zc2wcWM7BTQRVy5+RARAA59fefSDR 9nMGCb9LbMX+TFAoIQo/wgP5XPyzLYakO+94GrgfZjfhdaxPXMsl2+o8jhp/hlIzG56taNdt VZtPp3ih1AgbR8rHgXw1xwOpuAd5lE1qNd54ndHuADO9a9A0vPimIes78Hi1/yy+ZEEvRkHk /kDa6F3AtTc1m4rbbOk2fiKzzsE9YXweFjQvl9p+AMw6qd/iC4lUk9g0+FQXNdRs+o4o6Qvy iOQJfGQ4UcBuOy1IrkJrd8qq5jet1fcM2j4QvsW8CLDWZS1L7kZ5gT5EycMKxUWb8LuRjxzZ 3QY1aQH2kkzn6acigU3HLtgFyV1gBNV44ehjgvJpRY2cC8VhanTx0dZ9mj1YKIky5N+C0f21 zvntBqcxV0+3p8MrxRRcgEtDZNav+xAoT3G0W4SahAaUTWXpsZoOecwtxi74CyneQNPTDjNg azHmvpdBVEfj7k3p4dmJp5i0U66Onmf6mMFpArvBRSMOKU9DlAzMi4IvhiNWjKVaIE2Se9BY FdKVAJaZq85P2y20ZBd08ILnKcj7XKZkLU5FkoA0udEBvQ0f9QLNyyy3DZMCQWcwRuj1m73D sq8DEFBdZ5eEkj1dCyx+t/ga6x2rHyc8Sl86oK1tvAkwBNsfKou3v+jP/l14a7DGBvrmlYjO 59o3t6inu6H7pt7OL6u6BQj7DoMAEQEAAcLBfAQYAQgAJgIbDBYhBBvZyq1zXEw6Rg38yk3e EPcA/4NaBQJonNqrBQkmWAihAAoJEE3eEPcA/4NaKtMQALAJ8PzprBEXbXcEXwDKQu+P/vts IfUb1UNMfMV76BicGa5NCZnJNQASDP/+bFg6O3gx5NbhHHPeaWz/VxlOmYHokHodOvtL0WCC 8A5PEP8tOk6029Z+J+xUcMrJClNVFpzVvOpb1lCbhjwAV465Hy+NUSbbUiRxdzNQtLtgZzOV Zw7jxUCs4UUZLQTCuBpFgb15bBxYZ/BL9MbzxPxvfUQIPbnzQMcqtpUs21CMK2PdfCh5c4gS sDci6D5/ZIBw94UQWmGpM/O1ilGXde2ZzzGYl64glmccD8e87OnEgKnH3FbnJnT4iJchtSvx yJNi1+t0+qDti4m88+/9IuPqCKb6Stl+s2dnLtJNrjXBGJtsQG/sRpqsJz5x1/2nPJSRMsx9 5YfqbdrJSOFXDzZ8/r82HgQEtUvlSXNaXCa95ez0UkOG7+bDm2b3s0XahBQeLVCH0mw3RAQg r7xDAYKIrAwfHHmMTnBQDPJwVqxJjVNr7yBic4yfzVWGCGNE4DnOW0vcIeoyhy9vnIa3w1uZ 3iyY2Nsd7JxfKu1PRhCGwXzRw5TlfEsoRI7V9A8isUCoqE2Dzh3FvYHVeX4Us+bRL/oqareJ CIFqgYMyvHj7Q06kTKmauOe4Nf0l0qEkIuIzfoLJ3qr5UyXc2hLtWyT9Ir+lYlX9efqh7mOY qIws/H2t In-Reply-To: <6D25DBDC7BEC853D+20260826063124.3255387-1-liudalin@kylinsec.com.cn> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 8/26/26 08:31, Liu Dalin wrote: > While the current callers either pass a valid pointer or explicitly > pass NULL (indicating they don't need the unlock notification), it is > safer to add a defensive NULL check before dereferencing. This prevents > a kernel crash if any caller passes NULL and handle_mm_fault() returns > VM_FAULT_COMPLETED or VM_FAULT_RETRY. > > Fixes smatch warnings: > - mm/gup.c:1597 fixup_user_fault() error: we previously assumed 'unlocked' could be null (see line 1573) > > Fixes: 4bbd4c776a63 ("mm: move get_user_pages()-related code to separate file") If this is not an actual bugfix, we should specify Fixes:. > Assisted-by: smatch:2.0 [static analysis] > Signed-off-by: Liu Dalin You seem to have sent this patch twice by accident. :) > --- > mm/gup.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/mm/gup.c b/mm/gup.c > index 0692119b7904..d12475a7f7cc 100644 > --- a/mm/gup.c > +++ b/mm/gup.c > @@ -1594,7 +1594,8 @@ int fixup_user_fault(struct mm_struct *mm, > * could tell the callers so they do not need to unlock. > */ > mmap_read_lock(mm); > - *unlocked = true; > + if (unlocked) > + *unlocked = true; > return 0; > } > > @@ -1608,7 +1609,8 @@ int fixup_user_fault(struct mm_struct *mm, > > if (ret & VM_FAULT_RETRY) { > mmap_read_lock(mm); > - *unlocked = true; > + if (unlocked) > + *unlocked = true; > fault_flags |= FAULT_FLAG_TRIED; > goto retry; > } smatch doesn't understand that VM_FAULT_RETRY|VM_FAULT_COMPLETED implies that FAULT_FLAG_ALLOW_RETRY must be set, which implies that the lock may be dropped, which implies that unlocked is mandatory to be specified by the caller. Checking for "unlocked" when we just did a mmap_read_lock() does not make any sense, sorry. Is there a way to teach smatch about this differently? VM_WARN_ON_ONCE(unlocked); could be used, but I am also not quite happy about that. -- Cheers, David