On 3/16/21 3:04 AM, Colin King wrote:
From: Colin Ian King <colin.king@xxxxxxxxxxxxx> At the start of the function there is a null pointer check on cma and then branch to error handling label 'out'. The subsequent call to cma_sysfs_fail_pages_count dereferences cma, hence there is a potential null pointer deference issue. Fix this by only calling
As far as I can tell, it's not possible to actually cause that null failure with the existing kernel code paths. *Might* be worth mentioning that here (unless I'm wrong), but either way, looks good, so: Reviewed-by: John Hubbard <jhubbard@xxxxxxxxxx> thanks, -- John Hubbard NVIDIA
cma_sysfs_fail_pages_count if cma is not null. Addresses-Coverity: ("Dereference after null check") Fixes: dc4764f7e9ac ("mm: cma: support sysfs") Signed-off-by: Colin Ian King <colin.king@xxxxxxxxxxxxx> --- mm/cma.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/mm/cma.c b/mm/cma.c index 6d4dbafdb318..90e27458ddb7 100644 --- a/mm/cma.c +++ b/mm/cma.c @@ -512,7 +512,8 @@ struct page *cma_alloc(struct cma *cma, size_t count, unsigned int align, cma_sysfs_alloc_pages_count(cma, count); } else { count_vm_event(CMA_ALLOC_FAIL); - cma_sysfs_fail_pages_count(cma, count); + if (cma) + cma_sysfs_fail_pages_count(cma, count); }return page;
