2022-12-15 09:48:01

by Anastasia Belova

Subject: [PATCH] mm: Add check for NULL for unlocked in fixup_user_fault

Check unlocked for NULL before dereference.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: d92725256b4f ("mm: avoid unnecessary page fault retires on shared memory types")
Signed-off-by: Anastasia Belova <[email protected]>
---
mm/gup.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/mm/gup.c b/mm/gup.c
index f212d571b563..905d5fb64c4c 100644
--- a/mm/gup.c
+++ b/mm/gup.c
@@ -1282,7 +1282,8 @@ int fixup_user_fault(struct mm_struct *mm,
* could tell the callers so they do not need to unlock.
*/
mmap_read_lock(mm);
- *unlocked = true;
+ if (unlocked)
+ *unlocked = true;
return 0;
}

--
2.30.2

2022-12-15 21:35:16

by Andrew Morton

Subject: Re: [PATCH] mm: Add check for NULL for unlocked in fixup_user_fault

On Thu, 15 Dec 2022 12:39:30 +0300 Anastasia Belova <[email protected]> wrote:

> Check unlocked for NULL before dereference.
>
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
>
> ...
>
> --- a/mm/gup.c
> +++ b/mm/gup.c
> @@ -1282,7 +1282,8 @@ int fixup_user_fault(struct mm_struct *mm,
> * could tell the callers so they do not need to unlock.
> */
> mmap_read_lock(mm);
> - *unlocked = true;
> + if (unlocked)
> + *unlocked = true;
> return 0;
> }

I don't believe this is necessary unless the caller passed
FAULT_FLAG_KILLABLE or FAULT_FLAG_ALLOW_RETRY in fault_flags.

It's clear as mud and some code comments would help.