[linux-next:master 6990/7953] mm/userfaultfd.c:1438 uffd_move_lock() error: we previously assumed '*src_vmap' could be null (see line 1423)

[linux-next:master 6990/7953] mm/userfaultfd.c:1438 uffd_move_lock() error: we previously assumed '*src_vmap' could be null (see line 1423)

[kernel test robot]

BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: Linux Memory Management List <linux-mm@kvack.org>
TO: Lokesh Gidra <lokeshgidra@google.com>
CC: Andrew Morton <akpm@linux-foundation.org>
CC: Linux Memory Management List <linux-mm@kvack.org>
CC: "Liam R. Howlett" <Liam.Howlett@oracle.com>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head:   35a4fdde2466b9d90af297f249436a270ef9d30e
commit: 17464ec6a91f3d4645b9795c5cb58d98bd643cf7 [6990/7953] userfaultfd: use per-vma locks in userfaultfd operations
:::::: branch date: 6 hours ago
:::::: commit date: 3 days ago
config: arm64-randconfig-r081-20240216 (https://download.01.org/0day-ci/archive/20240219/202402191900.1xNdILAX-lkp@intel.com/config)
compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project 36adfec155de366d722f2bac8ff9162289dcf06c)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202402191900.1xNdILAX-lkp@intel.com/

smatch warnings:
mm/userfaultfd.c:1438 uffd_move_lock() error: we previously assumed '*src_vmap' could be null (see line 1423)

vim +1438 mm/userfaultfd.c

17464ec6a91f3d Lokesh Gidra     2024-02-15  1385  
17464ec6a91f3d Lokesh Gidra     2024-02-15  1386  #ifdef CONFIG_PER_VMA_LOCK
17464ec6a91f3d Lokesh Gidra     2024-02-15  1387  static int uffd_move_lock(struct mm_struct *mm,
17464ec6a91f3d Lokesh Gidra     2024-02-15  1388  			  unsigned long dst_start,
17464ec6a91f3d Lokesh Gidra     2024-02-15  1389  			  unsigned long src_start,
17464ec6a91f3d Lokesh Gidra     2024-02-15  1390  			  struct vm_area_struct **dst_vmap,
17464ec6a91f3d Lokesh Gidra     2024-02-15  1391  			  struct vm_area_struct **src_vmap)
17464ec6a91f3d Lokesh Gidra     2024-02-15  1392  {
17464ec6a91f3d Lokesh Gidra     2024-02-15  1393  	struct vm_area_struct *vma;
17464ec6a91f3d Lokesh Gidra     2024-02-15  1394  	int err;
17464ec6a91f3d Lokesh Gidra     2024-02-15  1395  
17464ec6a91f3d Lokesh Gidra     2024-02-15  1396  	vma = lock_vma(mm, dst_start);
17464ec6a91f3d Lokesh Gidra     2024-02-15  1397  	if (IS_ERR(vma))
17464ec6a91f3d Lokesh Gidra     2024-02-15  1398  		return PTR_ERR(vma);
17464ec6a91f3d Lokesh Gidra     2024-02-15  1399  
17464ec6a91f3d Lokesh Gidra     2024-02-15  1400  	*dst_vmap = vma;
adef440691bab8 Andrea Arcangeli 2023-12-06  1401  	/*
17464ec6a91f3d Lokesh Gidra     2024-02-15  1402  	 * Skip finding src_vma if src_start is in dst_vma. This also ensures
17464ec6a91f3d Lokesh Gidra     2024-02-15  1403  	 * that we don't lock the same vma twice.
adef440691bab8 Andrea Arcangeli 2023-12-06  1404  	 */
17464ec6a91f3d Lokesh Gidra     2024-02-15  1405  	if (src_start >= vma->vm_start && src_start < vma->vm_end) {
17464ec6a91f3d Lokesh Gidra     2024-02-15  1406  		*src_vmap = vma;
17464ec6a91f3d Lokesh Gidra     2024-02-15  1407  		return 0;
17464ec6a91f3d Lokesh Gidra     2024-02-15  1408  	}
adef440691bab8 Andrea Arcangeli 2023-12-06  1409  
17464ec6a91f3d Lokesh Gidra     2024-02-15  1410  	/*
17464ec6a91f3d Lokesh Gidra     2024-02-15  1411  	 * Using lock_vma() to get src_vma can lead to following deadlock:
17464ec6a91f3d Lokesh Gidra     2024-02-15  1412  	 *
17464ec6a91f3d Lokesh Gidra     2024-02-15  1413  	 * Thread1				Thread2
17464ec6a91f3d Lokesh Gidra     2024-02-15  1414  	 * -------				-------
17464ec6a91f3d Lokesh Gidra     2024-02-15  1415  	 * vma_start_read(dst_vma)
17464ec6a91f3d Lokesh Gidra     2024-02-15  1416  	 *					mmap_write_lock(mm)
17464ec6a91f3d Lokesh Gidra     2024-02-15  1417  	 *					vma_start_write(src_vma)
17464ec6a91f3d Lokesh Gidra     2024-02-15  1418  	 * vma_start_read(src_vma)
17464ec6a91f3d Lokesh Gidra     2024-02-15  1419  	 * mmap_read_lock(mm)
17464ec6a91f3d Lokesh Gidra     2024-02-15  1420  	 *					vma_start_write(dst_vma)
17464ec6a91f3d Lokesh Gidra     2024-02-15  1421  	 */
17464ec6a91f3d Lokesh Gidra     2024-02-15  1422  	*src_vmap = lock_vma_under_rcu(mm, src_start);
17464ec6a91f3d Lokesh Gidra     2024-02-15 @1423  	if (likely(*src_vmap))
adef440691bab8 Andrea Arcangeli 2023-12-06  1424  		return 0;
17464ec6a91f3d Lokesh Gidra     2024-02-15  1425  
17464ec6a91f3d Lokesh Gidra     2024-02-15  1426  	/* Undo any locking and retry in mmap_lock critical section */
17464ec6a91f3d Lokesh Gidra     2024-02-15  1427  	vma_end_read(*dst_vmap);
17464ec6a91f3d Lokesh Gidra     2024-02-15  1428  
17464ec6a91f3d Lokesh Gidra     2024-02-15  1429  	mmap_read_lock(mm);
17464ec6a91f3d Lokesh Gidra     2024-02-15  1430  	err = find_vmas_mm_locked(mm, dst_start, src_start, dst_vmap, src_vmap);
17464ec6a91f3d Lokesh Gidra     2024-02-15  1431  	if (!err) {
17464ec6a91f3d Lokesh Gidra     2024-02-15  1432  		/*
17464ec6a91f3d Lokesh Gidra     2024-02-15  1433  		 * See comment in lock_vma() as to why not using
17464ec6a91f3d Lokesh Gidra     2024-02-15  1434  		 * vma_start_read() here.
17464ec6a91f3d Lokesh Gidra     2024-02-15  1435  		 */
17464ec6a91f3d Lokesh Gidra     2024-02-15  1436  		down_read(&(*dst_vmap)->vm_lock->lock);
17464ec6a91f3d Lokesh Gidra     2024-02-15  1437  		if (*dst_vmap != *src_vmap)
17464ec6a91f3d Lokesh Gidra     2024-02-15 @1438  			down_read(&(*src_vmap)->vm_lock->lock);
17464ec6a91f3d Lokesh Gidra     2024-02-15  1439  	}
17464ec6a91f3d Lokesh Gidra     2024-02-15  1440  	mmap_read_unlock(mm);
17464ec6a91f3d Lokesh Gidra     2024-02-15  1441  	return err;
17464ec6a91f3d Lokesh Gidra     2024-02-15  1442  }
17464ec6a91f3d Lokesh Gidra     2024-02-15  1443  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki