[PATCH 0/4] remove dead NULL checks after GFP_NOFAIL allocations

[PATCH 0/4] remove dead NULL checks after GFP_NOFAIL allocations

[Gou Hao]

This is a code cleanup series that removes unreachable
NULL checks (and associated error handling) that follow allocations
using __GFP_NOFAIL, which guarantees non-NULL return.

Gou Hao (4):
  powerpc/xive: remove dead NULL check after GFP_NOFAIL allocation
  drm: remove dead WARN_ON NULL check after GFP_NOFAIL allocation
  lib/test_hmm: remove dead NULL checks after GFP_NOFAIL allocations
  RDMA/cxgb4: remove dead NULL checks after GFP_NOFAIL allocations

 arch/powerpc/sysdev/xive/common.c  |  3 ---
 drivers/gpu/drm/drm_modeset_lock.c |  4 ----
 drivers/infiniband/hw/cxgb4/mem.c  | 10 ++--------
 lib/test_hmm.c                     |  6 ------
 4 files changed, 2 insertions(+), 21 deletions(-)

-- 
2.20.1

[PATCH 1/4] powerpc/xive: remove dead NULL check after GFP_NOFAIL allocation

[Gou Hao]

kzalloc_objs with the __GFP_NOFAIL flag will never return NULL, so the
subsequent NULL check is unreachable dead code. Remove it.

Signed-off-by: Gou Hao <gouhao@uniontech.com>
---
 arch/powerpc/sysdev/xive/common.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
index dadd1f46ec93..79d7854259cb 100644
--- a/arch/powerpc/sysdev/xive/common.c
+++ b/arch/powerpc/sysdev/xive/common.c
@@ -1134,9 +1134,6 @@ static int __init xive_init_ipis(void)
 
 	xive_ipis = kzalloc_objs(*xive_ipis, nr_node_ids,
 				 GFP_KERNEL | __GFP_NOFAIL);
-	if (!xive_ipis)
-		goto out_free_domain;
-
 	for_each_node(node) {
 		struct xive_ipi_desc *xid = &xive_ipis[node];
 		struct xive_ipi_alloc_info info = { node };
-- 
2.20.1

Re: [PATCH 1/4] powerpc/xive: remove dead NULL check after GFP_NOFAIL allocation

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

New issues:
- [Low] Unused label `out_free_domain:` causes a compiler warning.

Pre-existing issues:
- [High] Use-After-Free on early boot error path when `xive_init_ipis()` fails.
--

--- Patch [1]: [PATCH 1/4] powerpc/xive: remove dead NULL check after GFP_NOFAIL allocation ---
commit 4043ea10e99c6ca83c1b85c8920beef1a521e167
Author: Gou Hao <gouhao@uniontech.com>

powerpc/xive: remove dead NULL check after GFP_NOFAIL allocation
    
kzalloc_objs with the __GFP_NOFAIL flag will never return NULL, so the
subsequent NULL check is unreachable dead code. Remove it.

> diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
> index dadd1f46ec939..79d7854259cb4 100644
> --- a/arch/powerpc/sysdev/xive/common.c
> +++ b/arch/powerpc/sysdev/xive/common.c
> @@ -1134,9 +1134,6 @@ static int __init xive_init_ipis(void)
>  
>  	xive_ipis = kzalloc_objs(*xive_ipis, nr_node_ids,
>  				 GFP_KERNEL | __GFP_NOFAIL);
> -	if (!xive_ipis)
> -		goto out_free_domain;

[Severity: Low]
Does removing this goto leave out_free_domain: as an unused label at the
end of xive_init_ipis()? This might cause a compiler warning.

[Severity: High]
This isn't a bug introduced by this patch, but does the error path in
xive_init_ipis() lead to a use-after-free?

If irq_domain_alloc_irqs() fails later in this function, it takes the error
path:

arch/powerpc/sysdev/xive/common.c:xive_init_ipis() {
    ...
out_free_xive_ipis:
    kfree(xive_ipis);
out_free_domain:
    ...
}

The global pointer xive_ipis is freed but not set to NULL.

The caller xive_smp_probe() ignores the return value of xive_init_ipis() and
continues execution, eventually dereferencing the dangling pointer:

arch/powerpc/sysdev/xive/common.c:xive_smp_probe() {
    ...
    xive_init_ipis();

    /* Allocate and setup IPI for the boot CPU */
    xive_setup_cpu_ipi(smp_processor_id());
    ...
}

Which accesses the freed pointer:

arch/powerpc/sysdev/xive/common.c:xive_ipi_cpu_to_irq() {
    return xive_ipis[early_cpu_to_node(cpu)].irq;
}

Can this cause memory corruption or a crash if early IPI setup fails?

> -
>  	for_each_node(node) {
>  		struct xive_ipi_desc *xid = &xive_ipis[node];
>  		struct xive_ipi_alloc_info info = { node };

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723081813.176792-1-gouhao@uniontech.com?part=1

Re: [PATCH 1/4] powerpc/xive: remove dead NULL check after GFP_NOFAIL allocation

[Mukesh Kumar Chaurasiya]

On Thu, Jul 23, 2026 at 04:18:10PM +0800, Gou Hao wrote:
> kzalloc_objs with the __GFP_NOFAIL flag will never return NULL, so the
> subsequent NULL check is unreachable dead code. Remove it.
> 
> Signed-off-by: Gou Hao <gouhao@uniontech.com>
> ---
>  arch/powerpc/sysdev/xive/common.c | 3 ---
>  1 file changed, 3 deletions(-)
> 
> diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
> index dadd1f46ec93..79d7854259cb 100644
> --- a/arch/powerpc/sysdev/xive/common.c
> +++ b/arch/powerpc/sysdev/xive/common.c
> @@ -1134,9 +1134,6 @@ static int __init xive_init_ipis(void)
>  
>  	xive_ipis = kzalloc_objs(*xive_ipis, nr_node_ids,
>  				 GFP_KERNEL | __GFP_NOFAIL);
> -	if (!xive_ipis)
> -		goto out_free_domain;
This will be an unused label after this.

Regards,
Mukesh
> -
>  	for_each_node(node) {
>  		struct xive_ipi_desc *xid = &xive_ipis[node];
>  		struct xive_ipi_alloc_info info = { node };
> -- 
> 2.20.1
> 

Re: [PATCH 1/4] powerpc/xive: remove dead NULL check after GFP_NOFAIL allocation

[Gou Hao]

[-- Attachment #1: Type: text/plain, Size: 1119 bytes --]

On 7/23/26 17:37, Mukesh Kumar Chaurasiya wrote:
> On Thu, Jul 23, 2026 at 04:18:10PM +0800, Gou Hao wrote:
>> kzalloc_objs with the __GFP_NOFAIL flag will never return NULL, so the
>> subsequent NULL check is unreachable dead code. Remove it.
>>
>> Signed-off-by: Gou Hao<gouhao@uniontech.com>
>> ---
>>   arch/powerpc/sysdev/xive/common.c | 3 ---
>>   1 file changed, 3 deletions(-)
>>
>> diff --git a/arch/powerpc/sysdev/xive/common.c b/arch/powerpc/sysdev/xive/common.c
>> index dadd1f46ec93..79d7854259cb 100644
>> --- a/arch/powerpc/sysdev/xive/common.c
>> +++ b/arch/powerpc/sysdev/xive/common.c
>> @@ -1134,9 +1134,6 @@ static int __init xive_init_ipis(void)
>>   
>>   	xive_ipis = kzalloc_objs(*xive_ipis, nr_node_ids,
>>   				 GFP_KERNEL | __GFP_NOFAIL);
>> -	if (!xive_ipis)
>> -		goto out_free_domain;
> This will be an unused label after this.
>
> Regards,
> Mukesh

Thank you for the review. I will fix it in the next version.


thanks,

Gou Hao

>> -
>>   	for_each_node(node) {
>>   		struct xive_ipi_desc *xid = &xive_ipis[node];
>>   		struct xive_ipi_alloc_info info = { node };
>> -- 
>> 2.20.1
>>

[-- Attachment #2: Type: text/html, Size: 2308 bytes --]

[PATCH 2/4] drm: remove dead WARN_ON NULL check after GFP_NOFAIL allocation

[Gou Hao]

kzalloc_obj with the __GFP_NOFAIL flag will never return NULL, so the
subsequent WARN_ON(!ctx) is unreachable dead code. Remove it.

Signed-off-by: Gou Hao <gouhao@uniontech.com>
---
 drivers/gpu/drm/drm_modeset_lock.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/drivers/gpu/drm/drm_modeset_lock.c b/drivers/gpu/drm/drm_modeset_lock.c
index 2c806b0146d6..e14814c30d8c 100644
--- a/drivers/gpu/drm/drm_modeset_lock.c
+++ b/drivers/gpu/drm/drm_modeset_lock.c
@@ -149,11 +149,7 @@ void drm_modeset_lock_all(struct drm_device *dev)
 	int ret;
 
 	ctx = kzalloc_obj(*ctx, GFP_KERNEL | __GFP_NOFAIL);
-	if (WARN_ON(!ctx))
-		return;
-
 	mutex_lock(&config->mutex);
-
 	drm_modeset_acquire_init(ctx, 0);
 
 retry:
-- 
2.20.1

[PATCH 3/4] lib/test_hmm: remove dead NULL checks after GFP_NOFAIL allocations

[Gou Hao]

kvcalloc with the __GFP_NOFAIL flag will never return NULL, so the
subsequent NULL checks are unreachable dead code. Remove them.

Signed-off-by: Gou Hao <gouhao@uniontech.com>
---
 lib/test_hmm.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/lib/test_hmm.c b/lib/test_hmm.c
index 9c59d1ceb5b5..d615e4e5fc44 100644
--- a/lib/test_hmm.c
+++ b/lib/test_hmm.c
@@ -1209,16 +1209,10 @@ static int dmirror_migrate_to_device(struct dmirror *dmirror,
 	if (!mmget_not_zero(mm))
 		return -EINVAL;
 
-	ret = -ENOMEM;
 	src_pfns = kvcalloc(PTRS_PER_PTE, sizeof(*src_pfns),
 			  GFP_KERNEL | __GFP_NOFAIL);
-	if (!src_pfns)
-		goto free_mem;
-
 	dst_pfns = kvcalloc(PTRS_PER_PTE, sizeof(*dst_pfns),
 			  GFP_KERNEL | __GFP_NOFAIL);
-	if (!dst_pfns)
-		goto free_mem;
 
 	ret = 0;
 	mmap_read_lock(mm);
-- 
2.20.1

Re: [PATCH 3/4] lib/test_hmm: remove dead NULL checks after GFP_NOFAIL allocations

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Unchecked return value from folio_alloc() leading to a NULL pointer dereference under memory pressure.
- [High] VMA iteration on an external mm_struct is performed without checking if the address space is stable.
--

--- Patch [3]: [PATCH 3/4] lib/test_hmm: remove dead NULL checks after GFP_NOFAIL allocations ---
commit f8d849c03b7bcb5aa594e8169391ebb8d17dfdcc
Author: Gou Hao <gouhao@uniontech.com>

lib/test_hmm: remove dead NULL checks after GFP_NOFAIL allocations

This commit removes unreachable NULL checks for kvcalloc() allocations
that use the __GFP_NOFAIL flag. Since __GFP_NOFAIL guarantees the
allocation will succeed, checking the return value is unnecessary.

> diff --git a/lib/test_hmm.c b/lib/test_hmm.c
> index 9c59d1ceb5b57..d615e4e5fc447 100644
> --- a/lib/test_hmm.c
> +++ b/lib/test_hmm.c
> @@ -1209,16 +1209,10 @@ static int dmirror_migrate_to_device(struct dmirror *dmirror,
>  	if (!mmget_not_zero(mm))
>  		return -EINVAL;
>  
> -	ret = -ENOMEM;
>  	src_pfns = kvcalloc(PTRS_PER_PTE, sizeof(*src_pfns),
>  			  GFP_KERNEL | __GFP_NOFAIL);
> -	if (!src_pfns)
> -		goto free_mem;
> -
>  	dst_pfns = kvcalloc(PTRS_PER_PTE, sizeof(*dst_pfns),
>  			  GFP_KERNEL | __GFP_NOFAIL);
> -	if (!dst_pfns)
> -		goto free_mem;
>  
>  	ret = 0;
>  	mmap_read_lock(mm);

[Severity: High]
This is a pre-existing issue, but is it safe to iterate over the VMAs
of an external mm_struct here without first verifying the address space
is stable?

As noted in the MM subsystem guidelines, when iterating over VMAs on an
external mm_struct, we need to ensure the tree is stable:

lib/test_hmm.c:dmirror_migrate_to_device() {
    ...
    mmap_read_lock(mm);
    for (addr = start; addr < end; addr = next) {
        vma = vma_lookup(mm, addr);
    ...
}

If the target process is OOM-killed or fails dup_mmap(), the maple tree
could contain XA_ZERO_ENTRY markers, which might cause vma_lookup()
or the traversal to crash. Could this code call check_stable_address_space(mm)
right after acquiring the mmap lock?

[Severity: High]
This is another pre-existing issue in the same file, but could a failed
memory allocation cause a NULL pointer dereference under memory pressure?

In dmirror_device_evict_chunk(), folio_alloc() is called without the
__GFP_NOFAIL flag, but the return value is not checked before use:

lib/test_hmm.c:dmirror_device_evict_chunk() {
    ...
    dpage = folio_page(folio_alloc(GFP_HIGHUSER_MOVABLE,
                  order), 0);
    lock_page(dpage);
    ...
}

If folio_alloc() returns NULL due to memory pressure, folio_page() evaluates
to NULL, which is then unconditionally passed to lock_page(). Would it make
sense to add a NULL check here, or perhaps use __GFP_NOFAIL if the allocation
is truly required to succeed?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723081813.176792-1-gouhao@uniontech.com?part=3

[PATCH 4/4] RDMA/cxgb4: remove dead NULL checks after GFP_NOFAIL allocations

[Gou Hao]

alloc_skb() with the __GFP_NOFAIL flag will never return NULL,
so the subsequent NULL checks and error handling are unreachable
dead code. Remove them.

Signed-off-by: Gou Hao <gouhao@uniontech.com>
---
 drivers/infiniband/hw/cxgb4/mem.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
index cd1b01014198..08631de17c0a 100644
--- a/drivers/infiniband/hw/cxgb4/mem.c
+++ b/drivers/infiniband/hw/cxgb4/mem.c
@@ -74,11 +74,8 @@ static int _c4iw_write_mem_dma_aligned(struct c4iw_rdev *rdev, u32 addr,
 		c4iw_init_wr_wait(wr_waitp);
 	wr_len = roundup(sizeof(*req) + sizeof(*sgl), 16);
 
-	if (!skb) {
+	if (!skb)
 		skb = alloc_skb(wr_len, GFP_KERNEL | __GFP_NOFAIL);
-		if (!skb)
-			return -ENOMEM;
-	}
 	set_wr_txq(skb, CPL_PRIORITY_CONTROL, 0);
 
 	req = __skb_put_zero(skb, wr_len);
@@ -134,11 +131,8 @@ static int _c4iw_write_mem_inline(struct c4iw_rdev *rdev, u32 addr, u32 len,
 					 roundup(copy_len, T4_ULPTX_MIN_IO),
 				 16);
 
-		if (!skb) {
+		if (!skb)
 			skb = alloc_skb(wr_len, GFP_KERNEL | __GFP_NOFAIL);
-			if (!skb)
-				return -ENOMEM;
-		}
 		set_wr_txq(skb, CPL_PRIORITY_CONTROL, 0);
 
 		req = __skb_put_zero(skb, wr_len);
-- 
2.20.1

Re: [PATCH 4/4] RDMA/cxgb4: remove dead NULL checks after GFP_NOFAIL allocations

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] Fallback error path and chunking in `_c4iw_write_mem_dma` and `write_adapter_mem` trigger a use-after-free on caller-provided SKBs.
- [High] Unconditional double-free of `mhp->dereg_skb` in the error path of `c4iw_alloc_mr`.
--

--- Patch [4]: [PATCH 4/4] RDMA/cxgb4: remove dead NULL checks after GFP_NOFAIL allocations ---
commit 2b81b1933eb1e926287199e29810f5bc991be785
Author: Gou Hao <gouhao@uniontech.com>

RDMA/cxgb4: remove dead NULL checks after GFP_NOFAIL allocations
    
alloc_skb() with the __GFP_NOFAIL flag will never return NULL,
so the subsequent NULL checks and error handling are unreachable
dead code. Remove them.

> diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
> index cd1b010141984..08631de17c0a3 100644
> --- a/drivers/infiniband/hw/cxgb4/mem.c
> +++ b/drivers/infiniband/hw/cxgb4/mem.c
> @@ -74,11 +74,8 @@ static int _c4iw_write_mem_dma_aligned(struct c4iw_rdev *rdev, u32 addr,
>  		c4iw_init_wr_wait(wr_waitp);
>  	wr_len = roundup(sizeof(*req) + sizeof(*sgl), 16);
>  
> -	if (!skb) {
> +	if (!skb)
>  		skb = alloc_skb(wr_len, GFP_KERNEL | __GFP_NOFAIL);
> -		if (!skb)
> -			return -ENOMEM;
> -	}
>  	set_wr_txq(skb, CPL_PRIORITY_CONTROL, 0);

[Severity: High]
This is a pre-existing issue, but I noticed a potential use-after-free
related to how these skb pointers are passed in from caller functions.

Looking at _c4iw_write_mem_dma(), the chunking loop reuses the caller's skb
for multiple offload sends:

drivers/infiniband/hw/cxgb4/mem.c:_c4iw_write_mem_dma() {
    ...
	while (remain > inline_threshold) {
		// ...
		ret = _c4iw_write_mem_dma_aligned(rdev, addr, dmalen, daddr,
						 skb, remain ? NULL : wr_waitp);
		// ...
	}
	if (remain)
		ret = _c4iw_write_mem_inline(rdev, addr, remain, data, skb,
					     wr_waitp);
    ...
}

Since the first call to _c4iw_write_mem_dma_aligned() (or
_c4iw_write_mem_inline()) hands the skb to c4iw_ofld_send() which consumes it,
doesn't reusing this same skb pointer in subsequent loop iterations or the
remainder fallback trigger a use-after-free?

Similarly, in write_adapter_mem(), the fallback logic reuses the skb pointer
after _c4iw_write_mem_dma() has potentially consumed it during a failed
offload send:

drivers/infiniband/hw/cxgb4/mem.c:write_adapter_mem() {
    ...
	ret = _c4iw_write_mem_dma(rdev, addr, len, data, skb, wr_waitp);
	if (ret) {
		pr_warn_ratelimited("%s: dma map failure (non fatal)\n",
				    pci_name(rdev->lldi.pdev));
		ret = _c4iw_write_mem_inline(rdev, addr, len, data, skb,
					      wr_waitp);
	}
    ...
}

Could this fallback also result in a use-after-free if the skb was consumed
before the error was returned?

>  
>  	req = __skb_put_zero(skb, wr_len);
[ ... ]
> @@ -134,11 +131,8 @@ static int _c4iw_write_mem_inline(struct c4iw_rdev *rdev, u32 addr, u32 len,
>  					 roundup(copy_len, T4_ULPTX_MIN_IO),
>  				 16);
>  
> -		if (!skb) {
> +		if (!skb)
>  			skb = alloc_skb(wr_len, GFP_KERNEL | __GFP_NOFAIL);
> -			if (!skb)
> -				return -ENOMEM;
> -		}

[Severity: High]
This is also a pre-existing issue, but there appears to be a double-free
involving dereg_skb in the error path of c4iw_alloc_mr().

When finish_mem_reg() fails, it jumps to err_dereg_mem and calls dereg_mem()
with mhp->dereg_skb. This eventually passes the skb to c4iw_ofld_send()
which takes ownership of the skb.

drivers/infiniband/hw/cxgb4/mem.c:c4iw_alloc_mr() {
    ...
err_dereg_mem:
	dereg_mem(&rhp->rdev, mhp->attr.stag, mhp->attr.pbl_size,
		  mhp->attr.pbl_addr, mhp->dereg_skb, mhp->wr_waitp);
err_free_skb:
	kfree_skb(mhp->dereg_skb);
    ...
}

After dereg_mem() returns, the error path unconditionally calls kfree_skb()
on mhp->dereg_skb.

Does this unconditionally double-free the skb after it has already been handed
off to the network stack?

>  		set_wr_txq(skb, CPL_PRIORITY_CONTROL, 0);
>  
>  		req = __skb_put_zero(skb, wr_len);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260723081813.176792-1-gouhao@uniontech.com?part=4