[bug report] bad error return in walk_hugetlb_range()

[Dan Carpenter <dan.carpenter@linaro.org>]

This is really old code.  I think it's a bug in hugetlb.

	drivers/gpu/drm/xe/xe_gt_pagefault.c:353 pf_queue_work_func()
	warn: passing positive error code 's32min-(-12),(-10)-(-1),1' to 'ERR_PTR'

mm/pagewalk.c
   319  static int walk_hugetlb_range(unsigned long addr, unsigned long end,
   320                                struct mm_walk *walk)
   321  {
   322          struct vm_area_struct *vma = walk->vma;
   323          struct hstate *h = hstate_vma(vma);
   324          unsigned long next;
   325          unsigned long hmask = huge_page_mask(h);
   326          unsigned long sz = huge_page_size(h);
   327          pte_t *pte;
   328          const struct mm_walk_ops *ops = walk->ops;
   329          int err = 0;
   330  
   331          hugetlb_vma_lock_read(vma);
   332          do {
   333                  next = hugetlb_entry_end(h, addr, end);
   334                  pte = hugetlb_walk(vma, addr & hmask, sz);
   335                  if (pte)
   336                          err = ops->hugetlb_entry(pte, hmask, addr, next, walk);

The ->hugetlb_entry() is implemented by two functions which return
true/false instead of error codes.  Smatch thinks this 1 value gets
propagated back to pf_queue_work_func() and results an an Oops.

The two problem functions are hwpoison_hugetlb_range() and
pagemap_hugetlb_range() which returns PM_END_OF_BUFFER from
add_to_pagemap().

   337                  else if (ops->pte_hole)
   338                          err = ops->pte_hole(addr, next, -1, walk);
   339                  if (err)
   340                          break;
   341          } while (addr = next, addr != end);
   342          hugetlb_vma_unlock_read(vma);
   343  
   344          return err;
   345  }

regards,
dan carpenter