smatch warning in mm/mmap.c

smatch warning in mm/mmap.c

[Dan Carpenter]

Hi Rik,

This code generates a Smatch warning.  I normally ignore Smatch warnings
in mm because I'm not clever enough to mess with that, but this one is
pretty recent so I thought I'd ask.  Could you take a look?

mm/mmap.c +1980 __split_vma(57) error: we previously assumed 'new->vm_ops' could be null.
  1966          if (new->vm_ops && new->vm_ops->open)
                    ^^^^^^^^^^^
	We assume new->vm_ops can be NULL here.

  1967                  new->vm_ops->open(new);
  1968
  1969          if (new_below)
  1970                  err = vma_adjust(vma, addr, vma->vm_end, vma->vm_pgoff +
  1971                          ((addr - new->vm_start) >> PAGE_SHIFT), new);
  1972          else
  1973                  err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  1974
  1975          /* Success. */
  1976          if (!err)
  1977                  return 0;
  1978
  1979          /* Clean everything up if vma_adjust failed. */
  1980          new->vm_ops->close(new);
                ^^^^^^^^^^^^^^^^^^

	But we dereference it unconditionally here.  

The dereference was added in 5beb4930: "mm: change anon_vma linking to fix
multi-process server scalability issue".

regards,
dan carpenter

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>

[PATCH] mmap: check ->vm_ops before dereferencing

[Rik van Riel]

Check whether the VMA has a vm_ops before calling close, just
like we check vm_ops before calling open a few dozen lines
higher up in the function.

Signed-off-by: Rik van Riel <riel@redhat.com>
Reported-by: Dan Carpenter <error27@gmail.com>

diff --git a/mm/mmap.c b/mm/mmap.c
index f90ea92..456ec6f 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -1977,7 +1977,8 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
 		return 0;
 
 	/* Clean everything up if vma_adjust failed. */
-	new->vm_ops->close(new);
+	if (new->vm_ops && new->vm_ops->close)
+		new->vm_ops->close(new);
 	if (new->vm_file) {
 		if (vma->vm_flags & VM_EXECUTABLE)
 			removed_exe_file_vma(mm);

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in
the body to majordomo@kvack.org.  For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>