Re: [linux-next:master 9762/11953] mm/page_vma_mapped.c:246 page_vma_mapped_walk() warn: always true condition '(pvmw->nr_pages >= (1 << ( - (12)))) => (0-u64max >= 0)'

Matthew Wilcox
2022-03-13T04:06:57Z

On Sun, Mar 13, 2022 at 11:01:09AM +0800, kernel test robot wrote:
> tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
> head: 71941773e143369a73c9c4a3b62fbb60736a1182
> commit: b786e44a4dbfe64476e7120ec7990b89a37be37d [9762/11953] mm: Convert page_vma_mapped_walk to work on PFNs
> config: riscv-randconfig-m031-20220312 (https://download.01.org/0day-ci/archive/20220313/202203131056.WINF40Gt-lkp@intel.com/config)
> compiler: riscv64-linux-gcc (GCC) 11.2.0
>
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp@intel.com>
>
> smatch warnings:
> mm/page_vma_mapped.c:246 page_vma_mapped_walk() warn: always true condition '(pvmw->nr_pages >= (1 << ( - (12)))) => (0-u64max >= 0)'

Looks like a duplicate of https://lore.kernel.org/lkml/YgpzPru8aFA5sHOI@casper.infradead.org/

Dan, any thoughts? Do you consider this a false positive from smatch?

> vim +246 mm/page_vma_mapped.c
>
> 126
> 127 /**
> 128 * page_vma_mapped_walk - check if @pvmw->pfn is mapped in @pvmw->vma at
> 129 * @pvmw->address
> 130 * @pvmw: pointer to struct page_vma_mapped_walk. page, vma, address and flags
> 131 * must be set. pmd, pte and ptl must be NULL.
> 132 *
> 133 * Returns true if the page is mapped in the vma. @pvmw->pmd and @pvmw->pte point
> 134 * to relevant page table entries. @pvmw->ptl is locked. @pvmw->address is
> 135 * adjusted if needed (for PTE-mapped THPs).
> 136 *
> 137 * If @pvmw->pmd is set but @pvmw->pte is not, you have found PMD-mapped page
> 138 * (usually THP). For PTE-mapped THP, you should run page_vma_mapped_walk() in
> 139 * a loop to find all PTEs that map the THP.
> 140 *
> 141 * For HugeTLB pages, @pvmw->pte is set to the relevant page table entry
> 142 * regardless of which page table level the page is mapped at. @pvmw->pmd is
> 143 * NULL.
> 144 *
> 145 * Returns false if there are no more page table entries for the page in
> 146 * the vma. @pvmw->ptl is unlocked and @pvmw->pte is unmapped.
> 147 *
> 148 * If you need to stop the walk before page_vma_mapped_walk() returned false,
> 149 * use page_vma_mapped_walk_done(). It will do the housekeeping.
> 150 */
> 151 bool page_vma_mapped_walk(struct page_vma_mapped_walk *pvmw)
> 152 {
> 153 struct vm_area_struct *vma = pvmw->vma;
> 154 struct mm_struct *mm = vma->vm_mm;
> 155 unsigned long end;
> 156 pgd_t *pgd;
> 157 p4d_t *p4d;
> 158 pud_t *pud;
> 159 pmd_t pmde;
> 160
> 161 /* The only possible pmd mapping has been handled on last iteration */
> 162 if (pvmw->pmd && !pvmw->pte)
> 163 return not_found(pvmw);
> 164
> 165 if (unlikely(is_vm_hugetlb_page(vma))) {
> 166 unsigned long size = pvmw->nr_pages * PAGE_SIZE;
> 167 /* The only possible mapping was handled on last iteration */
> 168 if (pvmw->pte)
> 169 return not_found(pvmw);
> 170
> 171 /* when pud is not present, pte will be NULL */
> 172 pvmw->pte = huge_pte_offset(mm, pvmw->address, size);
> 173 if (!pvmw->pte)
> 174 return false;
> 175
> 176 pvmw->ptl = huge_pte_lockptr(size_to_hstate(size), mm,
> 177 pvmw->pte);
> 178 spin_lock(pvmw->ptl);
> 179 if (!check_pte(pvmw))
> 180 return not_found(pvmw);
> 181 return true;
> 182 }
> 183
> 184 end = vma_address_end(pvmw);
> 185 if (pvmw->pte)
> 186 goto next_pte;
> 187 restart:
> 188 do {
> 189 pgd = pgd_offset(mm, pvmw->address);
> 190 if (!pgd_present(*pgd)) {
> 191 step_forward(pvmw, PGDIR_SIZE);
> 192 continue;
> 193 }
> 194 p4d = p4d_offset(pgd, pvmw->address);
> 195 if (!p4d_present(*p4d)) {
> 196 step_forward(pvmw, P4D_SIZE);
> 197 continue;
> 198 }
> 199 pud = pud_offset(p4d, pvmw->address);
> 200 if (!pud_present(*pud)) {
> 201 step_forward(pvmw, PUD_SIZE);
> 202 continue;
> 203 }
> 204
> 205 pvmw->pmd = pmd_offset(pud, pvmw->address);
> 206 /*
> 207 * Make sure the pmd value isn't cached in a register by the
> 208 * compiler and used as a stale value after we've observed a
> 209 * subsequent update.
> 210 */
> 211 pmde = READ_ONCE(*pvmw->pmd);
> 212
> 213 if (pmd_trans_huge(pmde) || is_pmd_migration_entry(pmde)) {
> 214 pvmw->ptl = pmd_lock(mm, pvmw->pmd);
> 215 pmde = *pvmw->pmd;
> 216 if (likely(pmd_trans_huge(pmde))) {
> 217 if (pvmw->flags & PVMW_MIGRATION)
> 218 return not_found(pvmw);
> 219 if (!check_pmd(pmd_pfn(pmde), pvmw))
> 220 return not_found(pvmw);
> 221 return true;
> 222 }
> 223 if (!pmd_present(pmde)) {
> 224 swp_entry_t entry;
> 225
> 226 if (!thp_migration_supported() ||
> 227 !(pvmw->flags & PVMW_MIGRATION))
> 228 return not_found(pvmw);
> 229 entry = pmd_to_swp_entry(pmde);
> 230 if (!is_migration_entry(entry) ||
> 231 !check_pmd(swp_offset(entry), pvmw))
> 232 return not_found(pvmw);
> 233 return true;
> 234 }
> 235 /* THP pmd was split under us: handle on pte level */
> 236 spin_unlock(pvmw->ptl);
> 237 pvmw->ptl = NULL;
> 238 } else if (!pmd_present(pmde)) {
> 239 /*
> 240 * If PVMW_SYNC, take and drop THP pmd lock so that we
> 241 * cannot return prematurely, while zap_huge_pmd() has
> 242 * cleared *pmd but not decremented compound_mapcount().
> 243 */
> 244 if ((pvmw->flags & PVMW_SYNC) &&
> 245 transparent_hugepage_active(vma) &&
> > 246 (pvmw->nr_pages >= HPAGE_PMD_NR)) {
> 247 spinlock_t *ptl = pmd_lock(mm, pvmw->pmd);
> 248
> 249 spin_unlock(ptl);
> 250 }
> 251 step_forward(pvmw, PMD_SIZE);
> 252 continue;
> 253 }
> 254 if (!map_pte(pvmw))
> 255 goto next_pte;
> 256 this_pte:
> 257 if (check_pte(pvmw))
> 258 return true;
> 259 next_pte:
> 260 do {
> 261 pvmw->address += PAGE_SIZE;
> 262 if (pvmw->address >= end)
> 263 return not_found(pvmw);
> 264 /* Did we cross page table boundary? */
> 265 if ((pvmw->address & (PMD_SIZE - PAGE_SIZE)) == 0) {
> 266 if (pvmw->ptl) {
> 267 spin_unlock(pvmw->ptl);
> 268 pvmw->ptl = NULL;
> 269 }
> 270 pte_unmap(pvmw->pte);
> 271 pvmw->pte = NULL;
> 272 goto restart;
> 273 }
> 274 pvmw->pte++;
> 275 if ((pvmw->flags & PVMW_SYNC) && !pvmw->ptl) {
> 276 pvmw->ptl = pte_lockptr(mm, pvmw->pmd);
> 277 spin_lock(pvmw->ptl);
> 278 }
> 279 } while (pte_none(*pvmw->pte));
> 280
> 281 if (!pvmw->ptl) {
> 282 pvmw->ptl = pte_lockptr(mm, pvmw->pmd);
> 283 spin_lock(pvmw->ptl);
> 284 }
> 285 goto this_pte;
> 286 } while (pvmw->address < end);
> 287
> 288 return false;
> 289 }
> 290
>
> ---
> 0-DAY CI Kernel Test Service
> https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org
>