[PATCH] selftests/mm/pagemap_ioctl: Fix missing NULL checks after calloc()

[PATCH] selftests/mm/pagemap_ioctl: Fix missing NULL checks after calloc()

[longlong yan]

The pagemap_ioctl selftest allocates memory via calloc() in several
places but does not check the return values. If calloc() fails, the
subsequent code will dereference a NULL pointer and crash.

Additionally, in sanity_tests(), the calloc() failure check incorrectly
uses MAP_FAILED (the mmap() error constant) instead of NULL. Since
calloc() returns NULL on failure, the check never triggers and a
failed allocation goes undetected.

Add NULL checks after each calloc() call, and fix the wrong error
constant in sanity_tests(). Use ksft_exit_fail_msg() consistent with
the existing error handling pattern in the file.

Signed-off-by: longlong yan <yanlonglong@kylinos.cn>
---
 tools/testing/selftests/mm/pagemap_ioctl.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/mm/pagemap_ioctl.c b/tools/testing/selftests/mm/pagemap_ioctl.c
index f9bcff8e78fa..f6629f44a13d 100644
--- a/tools/testing/selftests/mm/pagemap_ioctl.c
+++ b/tools/testing/selftests/mm/pagemap_ioctl.c
@@ -212,6 +212,8 @@ int userfaultfd_tests(void)
 
 	vec_size = mem_size/page_size;
 	vec = calloc(vec_size, sizeof(struct page_region));
+	if (!vec)
+		ksft_exit_fail_msg("error nomem\n");
 
 	written = pagemap_ioctl(mem, mem_size, vec, 1, PM_SCAN_WP_MATCHING | PM_SCAN_CHECK_WPASYNC,
 				vec_size - 2, PAGE_IS_WRITTEN, 0, 0, PAGE_IS_WRITTEN);
@@ -699,6 +701,8 @@ int base_tests(char *prefix, char *mem, unsigned long long mem_size, int skip)
 	vec_size = mem_size/page_size;
 	vec = calloc(vec_size, sizeof(struct page_region));
 	vec2 = calloc(vec_size, sizeof(struct page_region));
+	if (!vec || !vec2)
+		ksft_exit_fail_msg("error nomem\n");
 
 	/* 1. all new pages must be not be written (dirty) */
 	written = pagemap_ioctl(mem, mem_size, vec, 1, PM_SCAN_WP_MATCHING | PM_SCAN_CHECK_WPASYNC,
@@ -1000,6 +1004,8 @@ int unmapped_region_tests(void)
 	int written, len = 0x00040000;
 	long vec_size = len / page_size;
 	struct page_region *vec = calloc(vec_size, sizeof(struct page_region));
+	if (!vec)
+		ksft_exit_fail_msg("error nomem\n");
 
 	/* 1. Get written pages */
 	written = pagemap_ioctl(start, len, vec, vec_size, 0, 0,
@@ -1116,7 +1122,7 @@ int sanity_tests(void)
 
 	vec = calloc(vec_size, sizeof(struct page_region));
 	mem = mmap(NULL, mem_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
-	if (mem == MAP_FAILED || vec == MAP_FAILED)
+	if (mem == MAP_FAILED || !vec)
 		ksft_exit_fail_msg("error nomem\n");
 
 	wp_init(mem, mem_size);
-- 
2.43.0

Re: [PATCH] selftests/mm/pagemap_ioctl: Fix missing NULL checks after calloc()

[David Hildenbrand (Arm)]

On 7/21/26 08:36, longlong yan wrote:
> The pagemap_ioctl selftest allocates memory via calloc() in several
> places but does not check the return values. If calloc() fails, the
> subsequent code will dereference a NULL pointer and crash.
> 
> Additionally, in sanity_tests(), the calloc() failure check incorrectly
> uses MAP_FAILED (the mmap() error constant) instead of NULL. Since
> calloc() returns NULL on failure, the check never triggers and a
> failed allocation goes undetected.
> 
> Add NULL checks after each calloc() call, and fix the wrong error
> constant in sanity_tests(). Use ksft_exit_fail_msg() consistent with
> the existing error handling pattern in the file.
> 
> Signed-off-by: longlong yan <yanlonglong@kylinos.cn>
> ---
>  tools/testing/selftests/mm/pagemap_ioctl.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/testing/selftests/mm/pagemap_ioctl.c b/tools/testing/selftests/mm/pagemap_ioctl.c
> index f9bcff8e78fa..f6629f44a13d 100644
> --- a/tools/testing/selftests/mm/pagemap_ioctl.c
> +++ b/tools/testing/selftests/mm/pagemap_ioctl.c
> @@ -212,6 +212,8 @@ int userfaultfd_tests(void)
>  
>  	vec_size = mem_size/page_size;
>  	vec = calloc(vec_size, sizeof(struct page_region));
> +	if (!vec)
> +		ksft_exit_fail_msg("error nomem\n");
>  
>  	written = pagemap_ioctl(mem, mem_size, vec, 1, PM_SCAN_WP_MATCHING | PM_SCAN_CHECK_WPASYNC,
>  				vec_size - 2, PAGE_IS_WRITTEN, 0, 0, PAGE_IS_WRITTEN);
> @@ -699,6 +701,8 @@ int base_tests(char *prefix, char *mem, unsigned long long mem_size, int skip)
>  	vec_size = mem_size/page_size;
>  	vec = calloc(vec_size, sizeof(struct page_region));
>  	vec2 = calloc(vec_size, sizeof(struct page_region));
> +	if (!vec || !vec2)
> +		ksft_exit_fail_msg("error nomem\n");
>  
>  	/* 1. all new pages must be not be written (dirty) */
>  	written = pagemap_ioctl(mem, mem_size, vec, 1, PM_SCAN_WP_MATCHING | PM_SCAN_CHECK_WPASYNC,
> @@ -1000,6 +1004,8 @@ int unmapped_region_tests(void)
>  	int written, len = 0x00040000;
>  	long vec_size = len / page_size;
>  	struct page_region *vec = calloc(vec_size, sizeof(struct page_region));
> +	if (!vec)
> +		ksft_exit_fail_msg("error nomem\n");
>  
>  	/* 1. Get written pages */
>  	written = pagemap_ioctl(start, len, vec, vec_size, 0, 0,
> @@ -1116,7 +1122,7 @@ int sanity_tests(void)
>  
>  	vec = calloc(vec_size, sizeof(struct page_region));
>  	mem = mmap(NULL, mem_size, PROT_READ | PROT_WRITE, MAP_PRIVATE | MAP_ANON, -1, 0);
> -	if (mem == MAP_FAILED || vec == MAP_FAILED)
> +	if (mem == MAP_FAILED || !vec)
>  		ksft_exit_fail_msg("error nomem\n");
>  
>  	wp_init(mem, mem_size);

Acked-by: David Hildenbrand (Arm) <david@kernel.org>

-- 
Cheers,

David

Re: [PATCH] selftests/mm/pagemap_ioctl: Fix missing NULL checks after calloc()

[SJ Park]

Hello longlong,


I found get_maitnainer.pl is suggesting to Cc below recipients.

- Lorenzo Stoakes <ljs@kernel.org>
- "Liam R. Howlett" <liam@infradead.org>
- Vlastimil Babka <vbabka@kernel.org>
- Mike Rapoport <rppt@kernel.org>
- Suren Baghdasaryan <surenb@google.com>
- Michal Hocko <mhocko@suse.com>

On Tue, 21 Jul 2026 14:36:11 +0800 longlong yan <yanlonglong@kylinos.cn> wrote:

> The pagemap_ioctl selftest allocates memory via calloc() in several
> places but does not check the return values. If calloc() fails, the
> subsequent code will dereference a NULL pointer and crash.
> 
> Additionally, in sanity_tests(), the calloc() failure check incorrectly
> uses MAP_FAILED (the mmap() error constant) instead of NULL. Since
> calloc() returns NULL on failure, the check never triggers and a
> failed allocation goes undetected.
> 
> Add NULL checks after each calloc() call, and fix the wrong error
> constant in sanity_tests(). Use ksft_exit_fail_msg() consistent with
> the existing error handling pattern in the file.

Makes sense to me.

> 
> Signed-off-by: longlong yan <yanlonglong@kylinos.cn>

I have a trivial comment below.  Regardless of that,

Reviewed-by: SJ Park <sj@kernel.org>

> ---
>  tools/testing/selftests/mm/pagemap_ioctl.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
[...]
> @@ -1000,6 +1004,8 @@ int unmapped_region_tests(void)
>  	int written, len = 0x00040000;
>  	long vec_size = len / page_size;
>  	struct page_region *vec = calloc(vec_size, sizeof(struct page_region));
> +	if (!vec)
> +		ksft_exit_fail_msg("error nomem\n");

I'd suggest to separate the definitions and statements by putting an empty line
in the middle.


Thanks,
SJ

[...]