[PATCH] MIPS: Fix incorrect NULL check in local_flush_tlb_page()

[PATCH] MIPS: Fix incorrect NULL check in local_flush_tlb_page()

[Emil Goode]

We check that the struct vm_area_struct pointer vma is NULL and
then dereference it. The intent must have been to check that
vma is not NULL before we dereference it in the next condition.

Signed-off-by: Emil Goode <emilgoode@gmail.com>
---
 arch/mips/mm/tlb-r3k.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/mips/mm/tlb-r3k.c b/arch/mips/mm/tlb-r3k.c
index d657493..6546758 100644
--- a/arch/mips/mm/tlb-r3k.c
+++ b/arch/mips/mm/tlb-r3k.c
@@ -158,7 +158,7 @@ void local_flush_tlb_page(struct vm_area_struct *vma, unsigned long page)
 {
 	int cpu = smp_processor_id();
 
-	if (!vma || cpu_context(cpu, vma->vm_mm) != 0) {
+	if (vma && cpu_context(cpu, vma->vm_mm) != 0) {
 		unsigned long flags;
 		int oldpid, newpid, idx;
 
-- 
1.7.10.4

Re: [PATCH] MIPS: Fix incorrect NULL check in local_flush_tlb_page()

[Jonas Gorski]

On Fri, Jul 4, 2014 at 7:07 PM, Emil Goode <emilgoode@gmail.com> wrote:
> We check that the struct vm_area_struct pointer vma is NULL and
> then dereference it. The intent must have been to check that
> vma is not NULL before we dereference it in the next condition.

Actually if it is NULL, then it will short-cut and won't dereference
it (because !vma is true it can never become false again), so the
condition would be fine previously.

But, looking at the code a few lines into branch:

        if (!vma || cpu_context(cpu, vma->vm_mm) != 0) {
                unsigned long flags;
                int oldpid, newpid, idx;

#ifdef DEBUG_TLB
                printk("[tlbpage<%lu,0x%08lx>]", cpu_context(cpu,
vma->vm_mm), page);
#endif
                newpid = cpu_context(cpu, vma->vm_mm) & ASID_MASK;

it will be then dereferenced here, so the change is actually sensible,
even if the description isn't quite spot-on where it breaks.


Jonas

Re: [PATCH] MIPS: Fix incorrect NULL check in local_flush_tlb_page()

[Emil Goode]

Hello Jonas,

On Fri, Jul 04, 2014 at 11:52:51PM +0200, Jonas Gorski wrote:
> On Fri, Jul 4, 2014 at 7:07 PM, Emil Goode <emilgoode@gmail.com> wrote:
> > We check that the struct vm_area_struct pointer vma is NULL and
> > then dereference it. The intent must have been to check that
> > vma is not NULL before we dereference it in the next condition.
> 
> Actually if it is NULL, then it will short-cut and won't dereference
> it (because !vma is true it can never become false again), so the
> condition would be fine previously.
> 
> But, looking at the code a few lines into branch:
> 
>         if (!vma || cpu_context(cpu, vma->vm_mm) != 0) {
>                 unsigned long flags;
>                 int oldpid, newpid, idx;
> 
> #ifdef DEBUG_TLB
>                 printk("[tlbpage<%lu,0x%08lx>]", cpu_context(cpu,
> vma->vm_mm), page);
> #endif
>                 newpid = cpu_context(cpu, vma->vm_mm) & ASID_MASK;
> 
> it will be then dereferenced here, so the change is actually sensible,
> even if the description isn't quite spot-on where it breaks.

Sorry, this is what I meant but failed to explain clearly.

Perhaps the following is a bit better?

We check that the struct vm_area_struct pointer vma is NULL and then
dereference it a few lines below. The intent must have been to make sure
that vma is not NULL and then to check the value from cpu_context() for the
condition to be true.

Best regards,

Emil Goode