linux-kernel - re: mm/shmem: turn shmem_alloc_page() into shmem_alloc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <9a206b6b-bb60-b86b-666d-c75748237cf0@gmail.com>
Date:   Wed, 4 May 2022 14:36:36 +0100
From:   "Colin King (gmail)" <colin.i.king@...il.com>
To:     Andrew Morton <akpm@...ux-foundation.org>,
        Linux-MM <linux-mm@...ck.org>, Hugh Dickins <hughd@...gle.com>,
        "Matthew Wilcox (Oracle)" <willy@...radead.org>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: re: mm/shmem: turn shmem_alloc_page() into shmem_alloc_folio()

Hi,

Static analysis with clang scan-build found an issue in the following 
commit:

commit b0bb08b2d5f399369a906eff0287e64b531881d8
Author: Matthew Wilcox (Oracle) <willy@...radead.org>
Date:   Fri Apr 29 14:43:02 2022 -0700

     mm/shmem: turn shmem_alloc_page() into shmem_alloc_folio()


The issue is as follows:

#ifdef CONFIG_USERFAULTFD
int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
                            pmd_t *dst_pmd,
                            struct vm_area_struct *dst_vma,
                            unsigned long dst_addr,
                            unsigned long src_addr,
                            bool zeropage, bool wp_copy,
                            struct page **pagep)
{
         struct inode *inode = file_inode(dst_vma->vm_file);
         struct shmem_inode_info *info = SHMEM_I(inode);
         struct address_space *mapping = inode->i_mapping;
         gfp_t gfp = mapping_gfp_mask(mapping);
         pgoff_t pgoff = linear_page_index(dst_vma, dst_addr);
         void *page_kaddr;
         struct folio *folio;
         struct page *page;

         ^^ page is not intialized

         int ret;
         pgoff_t max_off;

         if (!shmem_inode_acct_block(inode, 1)) {
                 /*
                  * We may have got a page, returned -ENOENT triggering 
a retry,
                  * and now we find ourselves with -ENOMEM. Release the 
page, to
                  * avoid a BUG_ON in our caller.
                  */
                 if (unlikely(*pagep)) {
                         put_page(*pagep);
                         *pagep = NULL;
                 }
                 return -ENOMEM;
         }

         if (!*pagep) {
                 ret = -ENOMEM;
                 if (!page)
                         goto out_unacct_blocks;

                 ^^ page is being referenced but it has not been set


The commit in question removed the assignment to page:

         if (!*pagep) {
                 ret = -ENOMEM;
-               page = shmem_alloc_page(gfp, info, pgoff);
                 if (!page)
                         goto out_unacct_blocks;


Colin