Hi Dmitry, kernel test robot noticed the following build warnings: https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/Dmitry-Osipenko/drm-shmem-helper-Fix-UAF-in-error-path-when-freeing-SGT-of-imported-GEM/20230904-011037 base: linus/master patch link: https://lore.kernel.org/r/20230903170736.513347-16-dmitry.osipenko%40collabora.com patch subject: [PATCH v16 15/20] drm/shmem-helper: Add memory shrinker config: x86_64-randconfig-161-20230907 (https://download.01.org/0day-ci/archive/20230907/202309070814.jyGJOJzY-lkp@xxxxxxxxx/config) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce: (https://download.01.org/0day-ci/archive/20230907/202309070814.jyGJOJzY-lkp@xxxxxxxxx/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@xxxxxxxxx> | Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> | Closes: https://lore.kernel.org/r/202309070814.jyGJOJzY-lkp@xxxxxxxxx/ smatch warnings: drivers/gpu/drm/drm_gem_shmem_helper.c:733 drm_gem_shmem_fault() error: we previously assumed 'shmem->pages' could be null (see line 724) vim +733 drivers/gpu/drm/drm_gem_shmem_helper.c 2194a63a818db7 Noralf Trønnes 2019-03-12 702 static vm_fault_t drm_gem_shmem_fault(struct vm_fault *vmf) 2194a63a818db7 Noralf Trønnes 2019-03-12 703 { 2194a63a818db7 Noralf Trønnes 2019-03-12 704 struct vm_area_struct *vma = vmf->vma; 2194a63a818db7 Noralf Trønnes 2019-03-12 705 struct drm_gem_object *obj = vma->vm_private_data; 2194a63a818db7 Noralf Trønnes 2019-03-12 706 struct drm_gem_shmem_object *shmem = to_drm_gem_shmem_obj(obj); 2194a63a818db7 Noralf Trønnes 2019-03-12 707 loff_t num_pages = obj->size >> PAGE_SHIFT; d611b4a0907cec Neil Roberts 2021-02-23 708 vm_fault_t ret; 2194a63a818db7 Noralf Trønnes 2019-03-12 709 struct page *page; 11d5a4745e00e7 Neil Roberts 2021-02-23 710 pgoff_t page_offset; 2c607edf57db6a Dmitry Osipenko 2023-09-03 711 bool pages_unpinned; 2c607edf57db6a Dmitry Osipenko 2023-09-03 712 int err; 11d5a4745e00e7 Neil Roberts 2021-02-23 713 11d5a4745e00e7 Neil Roberts 2021-02-23 714 /* We don't use vmf->pgoff since that has the fake offset */ 11d5a4745e00e7 Neil Roberts 2021-02-23 715 page_offset = (vmf->address - vma->vm_start) >> PAGE_SHIFT; 2194a63a818db7 Noralf Trønnes 2019-03-12 716 21aa27ddc58269 Dmitry Osipenko 2023-05-30 717 dma_resv_lock(shmem->base.resv, NULL); 2194a63a818db7 Noralf Trønnes 2019-03-12 718 2c607edf57db6a Dmitry Osipenko 2023-09-03 719 /* Sanity-check that we have the pages pointer when it should present */ 2c607edf57db6a Dmitry Osipenko 2023-09-03 720 pages_unpinned = (shmem->evicted || shmem->madv < 0 || 2c607edf57db6a Dmitry Osipenko 2023-09-03 721 !refcount_read(&shmem->pages_use_count)); 2c607edf57db6a Dmitry Osipenko 2023-09-03 722 drm_WARN_ON_ONCE(obj->dev, !shmem->pages ^ pages_unpinned); 2c607edf57db6a Dmitry Osipenko 2023-09-03 723 2c607edf57db6a Dmitry Osipenko 2023-09-03 @724 if (page_offset >= num_pages || (!shmem->pages && !shmem->evicted)) { ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Should this be || instead of &&? (The other thing that people do is add "!shmem->evicted" for readability even though it doesn't need to be checked. So maybe that's the issue, but the checker assumes it needs to be checked). d611b4a0907cec Neil Roberts 2021-02-23 725 ret = VM_FAULT_SIGBUS; d611b4a0907cec Neil Roberts 2021-02-23 726 } else { 2c607edf57db6a Dmitry Osipenko 2023-09-03 727 err = drm_gem_shmem_swapin_locked(shmem); Or maybe it's because the kbuild bot can't use the cross function db and shmem->pages is assigned here? 2c607edf57db6a Dmitry Osipenko 2023-09-03 728 if (err) { 2c607edf57db6a Dmitry Osipenko 2023-09-03 729 ret = VM_FAULT_OOM; 2c607edf57db6a Dmitry Osipenko 2023-09-03 730 goto unlock; 2c607edf57db6a Dmitry Osipenko 2023-09-03 731 } 2c607edf57db6a Dmitry Osipenko 2023-09-03 732 11d5a4745e00e7 Neil Roberts 2021-02-23 @733 page = shmem->pages[page_offset]; ^^^^^^^^^^^^ Unchecked dereference 2194a63a818db7 Noralf Trønnes 2019-03-12 734 8b93d1d7dbd578 Daniel Vetter 2021-08-12 735 ret = vmf_insert_pfn(vma, vmf->address, page_to_pfn(page)); d611b4a0907cec Neil Roberts 2021-02-23 736 } d611b4a0907cec Neil Roberts 2021-02-23 737 2c607edf57db6a Dmitry Osipenko 2023-09-03 738 unlock: 21aa27ddc58269 Dmitry Osipenko 2023-05-30 739 dma_resv_unlock(shmem->base.resv); d611b4a0907cec Neil Roberts 2021-02-23 740 d611b4a0907cec Neil Roberts 2021-02-23 741 return ret; 2194a63a818db7 Noralf Trønnes 2019-03-12 742 } -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki
