Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates
 216.228.112.34 as permitted sender) receiver=protection.outlook.com;
 client-ip=216.228.112.34; helo=mail.nvidia.com;
Subject: Re: [PATCH] mm: cma: Fix potential null dereference on pointer cma
To:     Colin King <colin.king@canonical.com>,
        Andrew Morton <akpm@linux-foundation.org>,
        Minchan Kim <minchan@kernel.org>,
        Stephen Rothwell <sfr@canb.auug.org.au>,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        <linux-mm@kvack.org>
CC:     <kernel-janitors@vger.kernel.org>, <linux-kernel@vger.kernel.org>
References: <20210316100433.17665-1-colin.king@canonical.com>
From:   John Hubbard <jhubbard@nvidia.com>
Message-ID: <c2881c32-4354-437d-749c-d6dd419e5a4d@nvidia.com>
Date:   Wed, 17 Mar 2021 00:13:31 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.8.1
MIME-Version: 1.0
In-Reply-To: <20210316100433.17665-1-colin.king@canonical.com>
Content-Type: text/plain; charset="utf-8"; format=flowed
Content-Language: en-US
Content-Transfer-Encoding: 7bit
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 17 Mar 2021 07:13:45.1583
 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 8ee14521-9ffb-409c-09e6-08d8e9143414
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.112.34];Helo=[mail.nvidia.com]
X-MS-Exchange-CrossTenant-AuthSource: CO1NAM11FT043.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: DM6PR12MB4957
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On 3/16/21 3:04 AM, Colin King wrote:
> From: Colin Ian King <colin.king@canonical.com>
> 
> At the start of the function there is a null pointer check on cma
> and then branch to error handling label 'out'.  The subsequent call
> to cma_sysfs_fail_pages_count dereferences cma, hence there is a
> potential null pointer deference issue.  Fix this by only calling

As far as I can tell, it's not possible to actually cause that null
failure with the existing kernel code paths.  *Might* be worth mentioning
that here (unless I'm wrong), but either way, looks good, so:

Reviewed-by: John Hubbard <jhubbard@nvidia.com>

thanks,
-- 
John Hubbard
NVIDIA

> cma_sysfs_fail_pages_count if cma is not null.
> 
> Addresses-Coverity: ("Dereference after null check")
> Fixes: dc4764f7e9ac ("mm: cma: support sysfs")
> Signed-off-by: Colin Ian King <colin.king@canonical.com>
> ---
>   mm/cma.c | 3 ++-
>   1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/mm/cma.c b/mm/cma.c
> index 6d4dbafdb318..90e27458ddb7 100644
> --- a/mm/cma.c
> +++ b/mm/cma.c
> @@ -512,7 +512,8 @@ struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align,
>   		cma_sysfs_alloc_pages_count(cma, count);
>   	} else {
>   		count_vm_event(CMA_ALLOC_FAIL);
> -		cma_sysfs_fail_pages_count(cma, count);
> +		if (cma)
> +			cma_sysfs_fail_pages_count(cma, count);
>   	}
>   
>   	return page;
>