[rcu:willy-maple 134/202] mm/mmap.c:2919 do_brk_munmap() error: we previously assumed 'vma->anon_vma' could be null (see line 2884)

From: Dan Carpenter
Date: Wed Feb 03 2021 - 08:16:28 EST

Next message:
Previous
Next in thread:
Messages

tree: If you fix the issue, Reported-by: kernel test Reported-by: Dan Carpenter
smatch warnings:
mm/mmap.c:2919 do_brk_munmap() mm/mmap.c:3039 do_brk_flags()
vim +2919 mm/mmap.c

5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett This code assumes "vma-&g
5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett Unchecked dereference
5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett ^1da177e4c3f41 Linus Torvalds 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett ^1da177e4c3f41 Linus Torvalds ^1da177e4c3f41 Linus Torvalds 5b05486ddd0127 Liam R. Howlett 3a459756810912 Kirill Korotaev ff68dac6d65cd1 Gaowei Pu d25a147c68d737 Liam R. Howlett ^1da177e4c3f41 Linus Torvalds 16e72e9b30986e Denys Vlasenko 16e72e9b30986e Denys Vlasenko 16e72e9b30986e Denys Vlasenko 16e72e9b30986e Denys Vlasenko 3a459756810912 Kirill Korotaev ff68dac6d65cd1 Gaowei Pu ff68dac6d65cd1 Gaowei Pu ff68dac6d65cd1 Gaowei Pu 3a459756810912 Kirill Korotaev 363ee17f0f405f Davidlohr Bueso 363ee17f0f405f Davidlohr Bueso 363ee17f0f405f Davidlohr Bueso ^1da177e4c3f41 Linus Torvalds 5b05486ddd0127 Liam R. Howlett 84638335900f19 Konstantin ^1da177e4c3f41 Linus Torvalds ^1da177e4c3f41 Linus Torvalds ^1da177e4c3f41 Linus Torvalds ^1da177e4c3f41 Linus Torvalds ^1da177e4c3f41 Linus Torvalds 191c542442fdf5 Al Viro ^1da177e4c3f41 Linus Torvalds ^1da177e4c3f41 Linus Torvalds 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett Check for NULL

5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett ^1da177e4c3f41 Linus Torvalds 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett ^1da177e4c3f41 Linus Torvalds 5b05486ddd0127 Liam R. Howlett 490fc053865c9c Linus Torvalds 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett ^1da177e4c3f41 Linus Torvalds bfd40eaff5abb9 Kirill A. Shutemov ^1da177e4c3f41 Linus Torvalds ^1da177e4c3f41 Linus Torvalds 5b05486ddd0127 Liam R. Howlett ^1da177e4c3f41 Linus Torvalds 3ed75eb8f1cd89 Coly Li 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett ^1da177e4c3f41 Linus Torvalds 3af9e859281bda Eric B Munson ^1da177e4c3f41 Linus Torvalds 84638335900f19 Konstantin 128557ffe147c2 Michel Lespinasse ba470de43188cd Rik van Riel d9104d1ca96624 Cyrill Gorcunov d25a147c68d737 Liam R. Howlett 5d22fc25d4fc80 Linus Torvalds 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett Unchecked

5b05486ddd0127 Liam R. Howlett 5b05486ddd0127 Liam R. Howlett
---
0-DAY CI Kernel Test Description: application/gzip Gerd Hoffmann: "[PATCH v5 3/6] drm/qxl: release shadow on shutdown" message: Miklos Szeredi: "Re: [PATCH 00/18] new API for FS_IOC_[GS]ETFLAGS/FS_IOC_FS[GS]ETXATTR" Liam Howlett: "Re: [rcu:willy-maple 134/202] mm/mmap.c:2919 do_brk_munmap() error: we previously assumed 'vma->anon_vma' could be null (see line 2884)" sorted by: [ date ] [ thread ] [ subject ] [ author ] href="https://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu.git">https://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu.git willy-maple
f39fa70456e0084c86
30ef547dba96a7abad [134/202] mm/mmap: Change do_brk_flags() to expand existing VMA and add do_brk_munmap()
(attached as .config)
9.3.0-15) 9.3.0
kindly add following tag as appropriate
robot <lkp@xxxxxxxxx>
<dan.carpenter@xxxxxxxxxx>
error: we previously assumed 'vma->anon_vma' could be null (see line 2884)
error: we previously assumed 'vma->anon_vma' could be null (see line 2980)
2020-09-21 2855 static int do_brk_munmap(struct ma_state *mas, struct vm_area_struct *vma,
2020-09-21 2856 unsigned long newbrk, unsigned long oldbrk,
2020-09-21 2857 struct list_head *uf)
2020-09-21 2858 {
2020-09-21 2859 struct mm_struct *mm = vma->vm_mm;
2020-09-21 2860 struct vm_area_struct unmap;
2020-09-21 2861 unsigned long unmap_pages;
2020-09-21 2862 int ret = 1;
2020-09-21 2863
2020-09-21 2864 arch_unmap(mm, newbrk, oldbrk);
2020-09-21 2865
2020-09-21 2866 if (likely(vma->vm_start >= newbrk)) { // remove entire mapping(s)
2020-09-21 2867 mas_set(mas, newbrk);
2020-09-21 2868 if (vma->vm_start != newbrk)
2020-09-21 2869 mas_reset(mas); // cause a re-walk for the first overlap.
2020-09-21 2870 ret = __do_munmap(mm, newbrk, oldbrk - newbrk, uf, true);
2020-09-21 2871 goto munmap_full_vma;
2020-09-21 2872 }
2020-09-21 2873
2020-09-21 2874 vma_init(&unmap, mm);
2020-09-21 2875 unmap.vm_start = newbrk;
2020-09-21 2876 unmap.vm_end = oldbrk;
2020-09-21 2877 ret = userfaultfd_unmap_prep(&unmap, newbrk, oldbrk, uf);
2020-09-21 2878 if (ret)
2020-09-21 2879 return ret;
2020-09-21 2880 ret = 1;
2020-09-21 2881
2020-09-21 2882 // Change the oldbrk of vma to the newbrk of the munmap area
2020-09-21 2883 vma_adjust_trans_huge(vma, vma->vm_start, newbrk, 0);
2020-09-21 @2884 if (vma->anon_vma) {
^^^^^^^^^^^^^
t;anon_vma" can be NULL.
2020-09-21 2885 anon_vma_lock_write(vma->anon_vma);
2020-09-21 2886 anon_vma_interval_tree_pre_update_vma(vma);
2020-09-21 2887 }
2020-09-21 2888
2020-09-21 2889 vma->vm_end = newbrk;
2020-09-21 2890 if (vma_mas_remove(&unmap, mas))
2020-09-21 2891 goto mas_store_fail;
2020-09-21 2892
2020-09-21 2893 vmacache_invalidate(vma->vm_mm);
2020-09-21 2894 if (vma->anon_vma) {
2020-09-21 2895 anon_vma_interval_tree_post_update_vma(vma);
2020-09-21 2896 anon_vma_unlock_write(vma->anon_vma);
2020-09-21 2897 }
2020-09-21 2898
2020-09-21 2899 unmap_pages = vma_pages(&unmap);
2020-09-21 2900 if (unmap.vm_flags & VM_LOCKED) {
2020-09-21 2901 mm->locked_vm -= unmap_pages;
2020-09-21 2902 munlock_vma_pages_range(&unmap, newbrk, oldbrk);
2020-09-21 2903 }
2020-09-21 2904
2020-09-21 2905 mmap_write_downgrade(mm);
2020-09-21 2906 unmap_region(mm, &unmap, vma, newbrk, oldbrk);
2020-09-21 2907 /* Statistics */
2020-09-21 2908 vm_stat_account(mm, unmap.vm_flags, -unmap_pages);
2020-09-21 2909 if (unmap.vm_flags & VM_ACCOUNT)
2020-09-21 2910 vm_unacct_memory(unmap_pages);
2020-09-21 2911
2020-09-21 2912 munmap_full_vma:
2020-09-21 2913 validate_mm_mt(mm);
2020-09-21 2914 return ret;
2020-09-21 2915
2020-09-21 2916 mas_store_fail:
2020-09-21 2917 vma->vm_end = oldbrk;
2020-09-21 2918 anon_vma_interval_tree_post_update_vma(vma);
2020-09-21 @2919 anon_vma_unlock_write(vma->anon_vma);
^^^^^^^^^^^^^
inside function call.
2020-09-21 2920 return -ENOMEM;
2020-09-21 2921 }
2020-09-21 2922
2020-09-21 2923 /*
2020-09-21 2924 * do_brk_flags() - Increase the brk vma if the flags match.
2020-09-21 2925 * @mas: The maple tree state.
2020-09-21 2926 * @addr: The start address
2020-09-21 2927 * @len: The length of the increase
2020-09-21 2928 * @vma: The vma,
2020-09-21 2929 * @flags: The VMA Flags
2020-09-21 2930 *
2020-09-21 2931 * Extend the brk VMA from addr to addr + len. If the VMA is NULL or the flags
2020-09-21 2932 * do not match then create a new anonymous VMA. Eventually we may be able to
2020-09-21 2933 * do some brk-specific accounting here.
2005-04-16 2934 */
2020-09-21 2935 static int do_brk_flags(struct ma_state *mas, struct vm_area_struct **brkvma,
2020-09-21 2936 unsigned long addr, unsigned long len,
2020-09-21 2937 unsigned long flags)
2005-04-16 2938 {
2005-04-16 2939 struct mm_struct *mm = current->mm;
2020-09-21 2940 struct vm_area_struct *prev = NULL, *vma;
2006-09-07 2941 int error;
2019-11-30 2942 unsigned long mapped_addr;
2020-07-24 2943 validate_mm_mt(mm);
2005-04-16 2944
2017-02-22 2945 /* Until we need other flags, refuse anything except VM_EXEC. */
2017-02-22 2946 if ((flags & (~VM_EXEC)) != 0)
2017-02-22 2947 return -EINVAL;
2017-02-22 2948 flags |= VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
2006-09-07 2949
2019-11-30 2950 mapped_addr = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
2019-11-30 2951 if (IS_ERR_VALUE(mapped_addr))
2019-11-30 2952 return mapped_addr;
2006-09-07 2953
2014-01-21 2954 error = mlock_future_check(mm, mm->def_flags, len);
2014-01-21 2955 if (error)
2014-01-21 2956 return error;
2005-04-16 2957
2020-09-21 2958 /* Check against address space limits by the changed size */
Khlebnikov 2016-01-14 2959 if (!may_expand_vm(mm, flags, len >> PAGE_SHIFT))
2005-04-16 2960 return -ENOMEM;
2005-04-16 2961
2005-04-16 2962 if (mm->map_count > sysctl_max_map_count)
2005-04-16 2963 return -ENOMEM;
2005-04-16 2964
2012-02-13 2965 if (security_vm_enough_memory_mm(mm, len >> PAGE_SHIFT))
2005-04-16 2966 return -ENOMEM;
2005-04-16 2967
2020-09-21 2968 mas->last = addr + len - 1;
2020-09-21 2969 if (*brkvma) {
2020-09-21 2970 vma = *brkvma;
2020-09-21 2971 /* Expand the existing vma if possible; almost never a singular
2020-09-21 2972 * list, so this will almost always fail. */
2020-09-21 2973
2020-09-21 2974 if ((!vma->anon_vma ||
^^^^^^^^^^^^^^
2020-09-21 2975 list_is_singular(&vma->anon_vma_chain)) &&
2020-09-21 2976 ((vma->vm_flags & ~VM_SOFTDIRTY) == flags)){
2020-09-21 2977 mas->index = vma->vm_start;
2020-09-21 2978
2020-09-21 2979 vma_adjust_trans_huge(vma, addr, addr + len, 0);
2020-09-21 @2980 if (vma->anon_vma) {
2020-09-21 2981 anon_vma_lock_write(vma->anon_vma);
2020-09-21 2982 anon_vma_interval_tree_pre_update_vma(vma);
2020-09-21 2983 }
2020-09-21 2984 vma->vm_end = addr + len;
2020-09-21 2985 vma->vm_flags |= VM_SOFTDIRTY;
2020-09-21 2986 if (mas_store_gfp(mas, vma, GFP_KERNEL))
2020-09-21 2987 goto mas_mod_fail;
2020-09-21 2988 if (vma->anon_vma) {
2020-09-21 2989 anon_vma_interval_tree_post_update_vma(vma);
2020-09-21 2990 anon_vma_unlock_write(vma->anon_vma);
2020-09-21 2991 }
2020-09-21 2992 khugepaged_enter_vma_merge(vma, flags);
2005-04-16 2993 goto out;
2020-09-21 2994 }
2020-09-21 2995 prev = vma;
2020-09-21 2996 }
2020-09-21 2997 mas->index = addr;
2020-09-21 2998 mas_walk(mas);
2005-04-16 2999
2020-09-21 3000 /* create a vma struct for an anonymous mapping */
2018-07-21 3001 vma = vm_area_alloc(mm);
2020-09-21 3002 if (!vma)
2020-09-21 3003 goto vma_alloc_fail;
2005-04-16 3004
2018-07-26 3005 vma_set_anonymous(vma);
2005-04-16 3006 vma->vm_start = addr;
2005-04-16 3007 vma->vm_end = addr + len;
2020-09-21 3008 vma->vm_pgoff = addr >> PAGE_SHIFT;
2005-04-16 3009 vma->vm_flags = flags;
2007-10-18 3010 vma->vm_page_prot = vm_get_page_prot(flags);
2020-09-21 3011 if (vma_mas_store(vma, mas))
2020-09-21 3012 goto mas_store_fail;
2020-09-21 3013
2020-09-21 3014 if (!prev)
2020-09-21 3015 prev = mas_prev(mas, 0);
2020-09-21 3016
2020-09-21 3017 __vma_link_list(mm, vma, prev);
2020-09-21 3018 mm->map_count++;
2020-09-21 3019 *brkvma = vma;
2005-04-16 3020 out:
2010-05-18 3021 perf_event_mmap(vma);
2005-04-16 3022 mm->total_vm += len >> PAGE_SHIFT;
Khlebnikov 2016-01-14 3023 mm->data_vm += len >> PAGE_SHIFT;
2013-02-22 3024 if (flags & VM_LOCKED)
2008-10-18 3025 mm->locked_vm += (len >> PAGE_SHIFT);
2013-09-11 3026 vma->vm_flags |= VM_SOFTDIRTY;
2020-07-24 3027 validate_mm_mt(mm);
2016-05-27 3028 return 0;
2020-09-21 3029
2020-09-21 3030 mas_store_fail:
2020-09-21 3031 vm_area_free(vma);
2020-09-21 3032 vma_alloc_fail:
2020-09-21 3033 vm_unacct_memory(len >> PAGE_SHIFT);
2020-09-21 3034 return -ENOMEM;
2020-09-21 3035
2020-09-21 3036 mas_mod_fail:
2020-09-21 3037 vma->vm_end = addr;
2020-09-21 3038 anon_vma_interval_tree_post_update_vma(vma);
2020-09-21 @3039 anon_vma_unlock_write(vma->anon_vma);
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
2020-09-21 3040 return -ENOMEM;
2020-09-21 3041
Service, Intel Corporation
://lists.01.org/hyperkitty/list/kbuild-all@xxxxxxxxxxxx">https://lists.01.org/hyperkitty/list/kbuild-all@xxxxxxxxxxxx
>.config.gz

Next message: Gerd Hoffmann: "[PATCH v5 3/6] drm/qxl: release shadow on shutdown"
Previous message: Miklos Szeredi: "Re: [PATCH 00/18] new API for FS_IOC_[GS]ETFLAGS/FS_IOC_FS[GS]ETXATTR"
Next in thread: Liam Howlett: "Re: [rcu:willy-maple 134/202] mm/mmap.c:2919 do_brk_munmap() error: we previously assumed 'vma->anon_vma' could be null (see line 2884)"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]