From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [davidhildenbrand:b4/uffd_marker_loss 3/4] mm/userfaultfd.c:236 mfill_get_vma() warn: bitwise AND condition is false here
Date: Fri, 06 Nov 2026 22:06:55 +0100 [thread overview]
Message-ID: <202611062242.DHsJsdWZ-lkp@intel.com> (raw)
Unfiltered warning: this smatch report is sent as-is and has not been
reviewed for false positives, so please treat it with due skepticism.
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: "David Hildenbrand (Arm)" <david@kernel.org>
tree: https://github.com/davidhildenbrand/linux b4/uffd_marker_loss
head: f873c4d8fea81d69055efcca51bad3c0dd0a4b04
commit: 4fbc77f3f8866a6ce733498aadfb4504febd08e6 [3/4] mm/userfaultfd: preserve poison markers after unregistering
:::::: branch date: 6 hours ago
:::::: commit date: 9 hours ago
config: microblaze-randconfig-2200-20261106 (https://download.01.org/0day-ci/archive/20261106/202611062242.DHsJsdWZ-lkp@intel.com/config)
compiler: microblaze-linux-gcc (GCC) 14.4.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202611062242.DHsJsdWZ-lkp@intel.com/
smatch warnings:
mm/userfaultfd.c:236 mfill_get_vma() warn: bitwise AND condition is false here
vim +236 mm/userfaultfd.c
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 194)
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 195) static int mfill_get_vma(struct mfill_state *state)
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 196) {
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 197) struct userfaultfd_ctx *ctx = state->ctx;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 198) uffd_flags_t flags = state->flags;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 199) struct vm_area_struct *dst_vma;
dfc4d771820a17 Mike Rapoport (Microsoft 2026-04-02 200) const struct vm_uffd_ops *ops;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 201) int err;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 202)
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 203) /*
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 204) * Make sure the vma is not shared, that the dst range is
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 205) * both valid and fully within a single existing vma.
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 206) */
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 207) dst_vma = uffd_mfill_lock(ctx->mm, state->dst_start, state->len);
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 208) if (IS_ERR(dst_vma))
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 209) return PTR_ERR(dst_vma);
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 210)
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 211) /*
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 212) * If memory mappings are changing because of non-cooperative
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 213) * operation (e.g. mremap) running in parallel, bail out and
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 214) * request the user to retry later
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 215) */
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 216) down_read(&ctx->map_changing_lock);
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 217) state->vma = dst_vma;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 218) err = -EAGAIN;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 219) if (atomic_read(&ctx->mmap_changing))
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 220) goto out_unlock;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 221)
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 222) err = -EINVAL;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 223)
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 224) /*
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 225) * shmem_zero_setup is invoked in mmap for MAP_ANONYMOUS|MAP_SHARED but
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 226) * it will overwrite vm_ops, so vma_is_anonymous must return false.
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 227) */
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 228) if (WARN_ON_ONCE(vma_is_anonymous(dst_vma) &&
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 229) dst_vma->vm_flags & VM_SHARED))
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 230) goto out_unlock;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 231)
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 232) /*
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 233) * validate 'mode' now that we know the dst_vma: don't allow
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 234) * a wrprotect copy if the userfaultfd didn't register as WP.
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 235) */
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 @236) if ((flags & MFILL_ATOMIC_WP) && !(dst_vma->vm_flags & VM_UFFD_WP))
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 237) goto out_unlock;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 238)
c911e7ebebf58c Lorenzo Stoakes (ARM 2026-10-13 239) if (vma_is_hugetlb(dst_vma))
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 240) return 0;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 241)
dfc4d771820a17 Mike Rapoport (Microsoft 2026-04-02 242) ops = vma_uffd_ops(dst_vma);
dfc4d771820a17 Mike Rapoport (Microsoft 2026-04-02 243) if (!ops)
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 244) goto out_unlock;
dfc4d771820a17 Mike Rapoport (Microsoft 2026-04-02 245)
dfc4d771820a17 Mike Rapoport (Microsoft 2026-04-02 246) if (uffd_flags_mode_is(flags, MFILL_ATOMIC_CONTINUE) &&
dfc4d771820a17 Mike Rapoport (Microsoft 2026-04-02 247) !ops->get_folio_noalloc)
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 248) goto out_unlock;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 249)
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 250) return 0;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 251)
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 252) out_unlock:
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 253) mfill_put_vma(state);
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 254) return err;
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 255) }
b8c03b7f455821 Mike Rapoport (Microsoft 2026-04-02 256)
:::::: The code at line 236 was first introduced by commit
:::::: b8c03b7f4558219ca09693b5fa4f5e068041d2c2 userfaultfd: introduce mfill_get_vma() and mfill_put_vma()
:::::: TO: Mike Rapoport (Microsoft) <rppt@kernel.org>
:::::: CC: Andrew Morton <akpm@linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-11-06 21:07 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202611062242.DHsJsdWZ-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.