Hi Baoquan, url: https://github.com/intel-lab-lkp/linux/commits/Baoquan-He/mm-vmalloc-c-add-used_map-into-vmap_block-to-track-space-of-vmap_block/20230113-112149 base: https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-everything patch link: https://lore.kernel.org/r/20230113031921.64716-4-bhe%40redhat.com patch subject: [PATCH v3 3/7] mm/vmalloc.c: allow vread() to read out vm_map_ram areas config: i386-randconfig-m021 compiler: gcc-11 (Debian 11.3.0-8) 11.3.0 If you fix the issue, kindly add following tag where applicable | Reported-by: kernel test robot <lkp@xxxxxxxxx> | Reported-by: Dan Carpenter <error27@xxxxxxxxx> smatch warnings: mm/vmalloc.c:3682 vread() error: we previously assumed 'vm' could be null (see line 3664) vim +/vm +3682 mm/vmalloc.c ^1da177e4c3f415 Linus Torvalds 2005-04-16 3630 long vread(char *buf, char *addr, unsigned long count) ^1da177e4c3f415 Linus Torvalds 2005-04-16 3631 { e81ce85f960c2e2 Joonsoo Kim 2013-04-29 3632 struct vmap_area *va; e81ce85f960c2e2 Joonsoo Kim 2013-04-29 3633 struct vm_struct *vm; ^1da177e4c3f415 Linus Torvalds 2005-04-16 3634 char *vaddr, *buf_start = buf; d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3635 unsigned long buflen = count; 129dbdf298d7383 Baoquan He 2023-01-13 3636 unsigned long n, size, flags; ^1da177e4c3f415 Linus Torvalds 2005-04-16 3637 4aff1dc4fb3a5a3 Andrey Konovalov 2022-03-24 3638 addr = kasan_reset_tag(addr); 4aff1dc4fb3a5a3 Andrey Konovalov 2022-03-24 3639 ^1da177e4c3f415 Linus Torvalds 2005-04-16 3640 /* Don't allow overflow */ ^1da177e4c3f415 Linus Torvalds 2005-04-16 3641 if ((unsigned long) addr + count < count) ^1da177e4c3f415 Linus Torvalds 2005-04-16 3642 count = -(unsigned long) addr; ^1da177e4c3f415 Linus Torvalds 2005-04-16 3643 e81ce85f960c2e2 Joonsoo Kim 2013-04-29 3644 spin_lock(&vmap_area_lock); f181234a5a21fd0 Chen Wandun 2021-09-02 3645 va = find_vmap_area_exceed_addr((unsigned long)addr); f608788cd2d6cae Serapheim Dimitropoulos 2021-04-29 3646 if (!va) f608788cd2d6cae Serapheim Dimitropoulos 2021-04-29 3647 goto finished; f181234a5a21fd0 Chen Wandun 2021-09-02 3648 f181234a5a21fd0 Chen Wandun 2021-09-02 3649 /* no intersects with alive vmap_area */ f181234a5a21fd0 Chen Wandun 2021-09-02 3650 if ((unsigned long)addr + count <= va->va_start) f181234a5a21fd0 Chen Wandun 2021-09-02 3651 goto finished; f181234a5a21fd0 Chen Wandun 2021-09-02 3652 f608788cd2d6cae Serapheim Dimitropoulos 2021-04-29 3653 list_for_each_entry_from(va, &vmap_area_list, list) { e81ce85f960c2e2 Joonsoo Kim 2013-04-29 3654 if (!count) e81ce85f960c2e2 Joonsoo Kim 2013-04-29 3655 break; e81ce85f960c2e2 Joonsoo Kim 2013-04-29 3656 129dbdf298d7383 Baoquan He 2023-01-13 3657 vm = va->vm; 129dbdf298d7383 Baoquan He 2023-01-13 3658 flags = va->flags & VMAP_FLAGS_MASK; 129dbdf298d7383 Baoquan He 2023-01-13 3659 129dbdf298d7383 Baoquan He 2023-01-13 3660 if (!vm && !flags) ^^^ vm can be NULL if a flag in VMAP_FLAGS_MASK is set. e81ce85f960c2e2 Joonsoo Kim 2013-04-29 3661 continue; e81ce85f960c2e2 Joonsoo Kim 2013-04-29 3662 129dbdf298d7383 Baoquan He 2023-01-13 3663 vaddr = (char *) va->va_start; 129dbdf298d7383 Baoquan He 2023-01-13 @3664 size = vm ? get_vm_area_size(vm) : va_size(va); ^^ 129dbdf298d7383 Baoquan He 2023-01-13 3665 129dbdf298d7383 Baoquan He 2023-01-13 3666 if (addr >= vaddr + size) ^1da177e4c3f415 Linus Torvalds 2005-04-16 3667 continue; ^1da177e4c3f415 Linus Torvalds 2005-04-16 3668 while (addr < vaddr) { ^1da177e4c3f415 Linus Torvalds 2005-04-16 3669 if (count == 0) ^1da177e4c3f415 Linus Torvalds 2005-04-16 3670 goto finished; ^1da177e4c3f415 Linus Torvalds 2005-04-16 3671 *buf = '\0'; ^1da177e4c3f415 Linus Torvalds 2005-04-16 3672 buf++; ^1da177e4c3f415 Linus Torvalds 2005-04-16 3673 addr++; ^1da177e4c3f415 Linus Torvalds 2005-04-16 3674 count--; ^1da177e4c3f415 Linus Torvalds 2005-04-16 3675 } 129dbdf298d7383 Baoquan He 2023-01-13 3676 n = vaddr + size - addr; d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3677 if (n > count) d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3678 n = count; 129dbdf298d7383 Baoquan He 2023-01-13 3679 129dbdf298d7383 Baoquan He 2023-01-13 3680 if (flags & VMAP_RAM) assume VMAP_RAM is not set 129dbdf298d7383 Baoquan He 2023-01-13 3681 vmap_ram_vread(buf, addr, n, flags); 129dbdf298d7383 Baoquan He 2023-01-13 @3682 else if (!(vm->flags & VM_IOREMAP)) ^^^^^^^^^ Unchecked dereference. Should this be "flags" instead of "vm->flags"? d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3683 aligned_vread(buf, addr, n); d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3684 else /* IOREMAP area is treated as memory hole */ d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3685 memset(buf, 0, n); d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3686 buf += n; d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3687 addr += n; d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3688 count -= n; ^1da177e4c3f415 Linus Torvalds 2005-04-16 3689 } ^1da177e4c3f415 Linus Torvalds 2005-04-16 3690 finished: e81ce85f960c2e2 Joonsoo Kim 2013-04-29 3691 spin_unlock(&vmap_area_lock); d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3692 d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3693 if (buf == buf_start) d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3694 return 0; d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3695 /* zero-fill memory holes */ d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3696 if (buf != buf_start + buflen) d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3697 memset(buf, 0, buflen - (buf - buf_start)); d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3698 d0107eb07320b5d KAMEZAWA Hiroyuki 2009-09-21 3699 return buflen; ^1da177e4c3f415 Linus Torvalds 2005-04-16 3700 } -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests
