linux-kernel - Re: mm/vmalloc.c:3689 vread_iter() error: we previously assumed 'vm' could be null (see line 3667)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZS/TVMT9ed7OdyNy@rli9-mobl>
Date:   Wed, 18 Oct 2023 20:45:08 +0800
From:   Philip Li <philip.li@...el.com>
To:     Baoquan He <bhe@...hat.com>
CC:     Dan Carpenter <dan.carpenter@...aro.org>,
        <oe-kbuild@...ts.linux.dev>, Lorenzo Stoakes <lstoakes@...il.com>,
        <lkp@...el.com>, <oe-kbuild-all@...ts.linux.dev>,
        <linux-kernel@...r.kernel.org>,
        "Andrew Morton" <akpm@...ux-foundation.org>,
        Linux Memory Management List <linux-mm@...ck.org>
Subject: Re: mm/vmalloc.c:3689 vread_iter() error: we previously assumed 'vm'
 could be null (see line 3667)

On Wed, Oct 18, 2023 at 08:12:30PM +0800, Baoquan He wrote:
> Hi Dan,
> 
> On 10/18/23 at 01:32pm, Dan Carpenter wrote:
> > On Wed, Oct 18, 2023 at 04:54:33PM +0800, Baoquan He wrote:
> > > Hi,
> > > 
> > > On 10/17/23 at 05:26pm, Dan Carpenter wrote:
> > > > tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> > > > head:   213f891525c222e8ed145ce1ce7ae1f47921cb9c
> > > > commit: 4c91c07c93bbbdd7f2d9de2beb7ee5c2a48ad8e7 mm: vmalloc: convert vread() to vread_iter()
> > > > config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20231017/202310171600.WCrsOwFj-lkp@intel.com/config)
> > > > compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
> > > > reproduce: (https://download.01.org/0day-ci/archive/20231017/202310171600.WCrsOwFj-lkp@intel.com/reproduce)
> > > > 
> > > > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > > > the same patch/commit), kindly add following tags
> > > > | Reported-by: kernel test robot <lkp@...el.com>
> > > > | Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
> > > > | Closes: https://lore.kernel.org/r/202310171600.WCrsOwFj-lkp@intel.com/
> > > > 
> > > > smatch warnings:
> > > > mm/vmalloc.c:3689 vread_iter() error: we previously assumed 'vm' could be null (see line 3667)
> > > 
> > > I see the code deficit, while the reproduce link seems to be unavilable.
> > > Could you double check the link and provide a good one so that I can
> > > verify the code fix?
> > 
> > Here's a link.  :)
> > 
> > https://repo.or.cz/smatch.git/blob/HEAD:/Documentation/smatch.txt
> > 
> > Just build it and run:
> > 
> > ~/smatch/smatch_scripts/kchecker drivers/whatever/file.c
> 
> I don't know smatch and lkp well, and have no idea on how to use above

Hi Baoquan, sorry there's issue in the generation of reproduce step, but even
it is generated, it doesn't contain the detail to setup smatch. You can follow
the smatch.txt to do the setup.

> smatch.txt to build the target file.c. I meant in this lkp report, the
> config file is available, however, the reproduce file is empty. Could
> you help add an available reproduce file link? or give a little more
> detail guiding me how to make use of above smatch file to build .c file?

On the other side, Dan has added analysis to the report as below.
It's possible to resolve the issue without running the smatch check.
You can give this a try.

	06c8994626d1b7 Baoquan He              2023-02-06  3657  		if (!vm && !flags)

	NULL check

	...

	06c8994626d1b7 Baoquan He              2023-02-06 @3689  		else if (!(vm->flags & VM_IOREMAP))
                                                                                   ^^^^^^^^^
	Unchecked dereference

> Thanks a lot in advance.
> 
> config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20231017/202310171600.WCrsOwFj-lkp@intel.com/config)
> reproduce: (https://download.01.org/0day-ci/archive/20231017/202310171600.WCrsOwFj-lkp@intel.com/reproduce)

Meanwhile, we will resolve the reproduce empty issue as early as possible.

> 
> Thanks
> Baoquan
> 
>