Re: [PATCH 2/8] mm/gup: convert follow_page_mask() to return a long

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] mm/gup: uninitialized page passed to gup_fill_pages() in __get_user_pages()
--

commit 125cbbdedc195fa32def929c325e903ddc88a720
Author: Rik van Riel <riel@surriel.com>

mm/gup: convert follow_page_mask() to return a long

This commit converts follow_page_mask() and its helpers to return a long
page count or negative errno instead of a struct page pointer, storing the
found page in pages[0].

> diff --git a/mm/gup.c b/mm/gup.c
> index cdbe2ed3e6442..f7d940e7e5ffb 100644
> --- a/mm/gup.c
> +++ b/mm/gup.c
[ ... ]
> @@ -1391,6 +1400,7 @@ static long __get_user_pages(struct mm_struct *mm,
>  	do {
>  		struct page *page;
>  		unsigned int page_increm;
> +		long nr;
>  
>  		/* first iteration or cross vma bound */
>  		if (!vma || start >= vma->vm_end) {
> @@ -1417,8 +1427,12 @@ static long __get_user_pages(struct mm_struct *mm,
>  						pages ? &page : NULL);
>  				if (ret)
>  					goto out;
> -				page_mask = 0;
> -				goto next_page;
> +				gup_fill_pages(vma, start, page, 1,
> +					       pages ? pages + i : NULL);

[Severity: Low]
As reported by Sashiko on RFC v3 [1], does this pass an uninitialized page
pointer to gup_fill_pages() when pages is NULL?

In __get_user_pages(), struct page *page is declared without an initializer
at the start of the loop. When pages is NULL in the gate area path,
get_gate_page() is called with NULL for its page argument and returns 0
without initializing page:

mm/gup.c:get_gate_page() {
    ...
	*vma = get_gate_vma(mm);
	if (!page)
		goto out;
	*page = vm_normal_page(*vma, address, entry);
    ...
out:
	ret = 0;
unmap:
	pte_unmap(pte);
	return ret;
}

Previously, jumping to next_page guarded the gup_fill_pages() call with
if (pages). Calling gup_fill_pages(vma, start, page, 1, ...) unconditionally
evaluates the uninitialized page variable to pass it by value when pages is
NULL.

[1] https://lore.kernel.org/r/20260811025157.1632867-3-riel@surriel.com

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261102193026.3860700-1-riel@surriel.com?part=2