On Tuesday 02 November 2010, Chew, Chiau Ee wrote:
> Hi Bergmann:
>
> Using the static analysis tool (Klocwork), we found the function calls in a particular code section
> (Line 65 to 69) under /include/asm-generic/memory_model.h may potentially lead to the occurrence of
> NULL pointer dereferencing. Below are the code snippets to explain how the NULL pointer dereferencing may occur.
Your analysis appears to be correct, but I don't know enough about this code to
understand if this is a problem. My understanding at this point is that it cannot
happen because of the way that memsections are done as long as a valid pfn is
passed into the function.
The pfn should always be valid because it comes from the kernel itself and only
very few functions call this. I have Cc'd the linux-mm mailing list for more input
on this.
Arnd
> Kernel version: 2.6.36
>
>
> -> /include/asm-generic/memory_model.h Line 67: '__sec' is assigned the
> return value from function '__pfn_to_section'
>
> Line 65-69 under /include/asm-generic/memory_model.h:
> #define __pfn_to_page(pfn) \
> ({ unsigned long __pfn = (pfn); \
> struct mem_section *__sec = __pfn_to_section(__pfn); \
> __section_mem_map_addr(__sec) + __pfn; \
> })
>
>
> -> /include/linux/mmzone.h Line1045: The return value of function
> '__pfn_to_section' is determined by function '__nr_to_section'
>
> Line 1043-1046 under /include/linux/mmzone.h
> static inline struct mem_section *__pfn_to_section(unsigned long pfn)
> {
> return __nr_to_section(pfn_to_section_nr(pfn));
> }
>
>
>
> -> /include/linux/mmzone.h Line 998-999: If
> mem_section[SECTION_NR_TO_ROOT(nr)]is false, then function
> '__nr_to_section' explicitly returns a NULL value,
> which eventually will be the value of __sec
>
> Line 996 to 1001 under /include/linux/mmzone.h
> static inline struct mem_section *__nr_to_section(unsigned long nr)
> {
> if (!mem_section[SECTION_NR_TO_ROOT(nr)])
> return NULL;
> return &mem_section[SECTION_NR_TO_ROOT(nr)][nr & SECTION_ROOT_MASK];
> }
>
> -> '__sec' is being passed to function '__section_mem_map_addr' as 'section'
> argument at Line 68 in include/asm-generic/memory_model.h. 'section' is
> explicitly dereference at Line 1018 in /include/linux/mmzone.h
>
> Line 65-69 under /include/asm-generic/memory_model.h:
> #define __pfn_to_page(pfn) \
> ({ unsigned long __pfn = (pfn); \
> struct mem_section *__sec = __pfn_to_section(__pfn); \
> __section_mem_map_addr(__sec) + __pfn; \
> })
>
> Line 1016-1021 under /include/linux/mmzone.h:
> static inline struct page *__section_mem_map_addr(struct mem_section *section)
> {
> unsigned long map = section->section_mem_map;
> map &= SECTION_MAP_MASK;
> return (struct page *)map;
> }
>
>
> Thanks,
> Chiau Ee
>
--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@xxxxxxxxxx For more info on Linux MM,
see: http://www.linux-mm.org/ .
Fight unfair telecom policy in Canada: sign http://dissolvethecrtc.ca/
Don't email: <a href=mailto:"dont@xxxxxxxxx";> email@xxxxxxxxx </a>