Re: [PATCH] arm64: hugetlb: avoid potential NULL dereference

Catalin Marinas
2020-05-06T10:18:24Z

On Tue, May 05, 2020 at 01:59:30PM +0100, Mark Rutland wrote:
> The static analyzer in GCC 10 spotted that in huge_pte_alloc() we may
> pass a NULL pmdp into pte_alloc_map() when pmd_alloc() returns NULL:
>
> | CC arch/arm64/mm/pageattr.o
> | CC arch/arm64/mm/hugetlbpage.o
> | from arch/arm64/mm/hugetlbpage.c:10:
> | arch/arm64/mm/hugetlbpage.c: In function ‘huge_pte_alloc’:
> | ./arch/arm64/include/asm/pgtable-types.h:28:24: warning: dereference of NULL ‘pmdp’ [CWE-690] [-Wanalyzer-null-dereference]
> | ./arch/arm64/include/asm/pgtable.h:436:26: note: in expansion of macro ‘pmd_val’
> | arch/arm64/mm/hugetlbpage.c:242:10: note: in expansion of macro ‘pte_alloc_map’
> | |arch/arm64/mm/hugetlbpage.c:232:10:
> | |./arch/arm64/include/asm/pgtable-types.h:28:24:
> | ./arch/arm64/include/asm/pgtable.h:436:26: note: in expansion of macro ‘pmd_val’
> | arch/arm64/mm/hugetlbpage.c:242:10: note: in expansion of macro ‘pte_alloc_map’
>
> This can only occur when the kernel cannot allocate a page, and so is
> unlikely to happen in practice before other systems start failing.
>
> We can avoid this by bailing out if pmd_alloc() fails, as we do earlier
> in the function if pud_alloc() fails.
>
> Fixes: 66b3923a1a0f77a5 ("arm64: hugetlb: add support for PTE contiguous bit)"
> Signed-off-by: Mark Rutland <mark.rutland@arm.com>
> Reported-by: Kyrill Tkachov <kyrylo.tkachov@arm.com>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Cc: Will Deacon <will@kernel.org>

Queued for 5.7-rc5. Thanks.

--
Catalin