Re: [linux-next:master] [mm] 480c454ff6: BUG:kernel_NULL_pointer_dereference

[Andrew Morton <akpm@linux-foundation.org>]

On Tue, 14 Mar 2023 10:10:42 +0800 kernel test robot <yujie.liu@intel.com> wrote:

> Greeting,
> 
> Previous report:
> https://lore.kernel.org/oe-lkp/202303100947.9b421b1c-yujie.liu@intel.com
> 
> FYI, we noticed BUG:kernel_NULL_pointer_dereference,address due to commit (built with gcc-11):
> 
> commit: 480c454ff64b734a35677ee4b239e32143a4235c ("mm: return an ERR_PTR from __filemap_get_folio")
> https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git master
> 
> [test failed on linux-next/master 24469a0e5052ba01a35a15f104717a82b7a4798b]
> 
> in testcase: trinity
> version: trinity-x86_64-e63e4843-1_20220913
> with following parameters:
> 
> 	runtime: 300s
> 	group: group-04
> 
> test-description: Trinity is a linux system call fuzz tester.
> test-url: http://codemonkey.org.uk/projects/trinity/
> 
> on test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
> 
> caused below changes (please refer to attached dmesg/kmsg for entire log/backtrace):
> 
> 
> [   29.300153][ T6430] BUG: kernel NULL pointer dereference, address: 0000000000000000

Thanks, I expect this is fixed by

commit 151dff099e8e6d9c8efcc75ad0ad3b8eead58704
Author: Christoph Hellwig <hch@lst.de>
Date:   Fri Mar 10 08:00:23 2023 +0100

    mm-return-an-err_ptr-from-__filemap_get_folio-fix
    
    fix null-pointer deref
    
    Link: https://lkml.kernel.org/r/20230310070023.GA13563@lst.de
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Reported-by: Naoya Horiguchi <naoya.horiguchi@linux.dev>
      Link: https://lkml.kernel.org/r/20230310043137.GA1624890@u2004
    Cc: Andreas Gruenbacher <agruenba@redhat.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Matthew Wilcox (Oracle) <willy@infradead.org>
    Cc: Ryusuke Konishi <konishi.ryusuke@gmail.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/mm/swap_state.c b/mm/swap_state.c
index c7160070b9da..b76a65ac28b3 100644
--- a/mm/swap_state.c
+++ b/mm/swap_state.c
@@ -390,6 +390,8 @@ struct folio *filemap_get_incore_folio(struct address_space *mapping,
 	struct swap_info_struct *si;
 	struct folio *folio = filemap_get_entry(mapping, index);
 
+	if (!folio)
+		return ERR_PTR(-ENOENT);
 	if (!xa_is_value(folio))
 		return folio;
 	if (!shmem_mapping(mapping))