From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-180.mta1.migadu.com (out-180.mta1.migadu.com [95.215.58.180]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C19A31C84A2 for ; Tue, 21 Apr 2026 08:51:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.180 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776761480; cv=none; b=L30TKk517YqPO+kKylW4XXQsH461hwq+JXXqwuoaJc/p/Ae8mtTT95Bphc9zl2/0Il7/e6WicltcKuNiAwRcrbSURaALIuXf8lueSrNvsNGoQQsg2+AzoiOIaFH5PD1apyVhKID/G2r/xkUmgGKzWb1fjKgNNpFYlobmJfUXy/I= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1776761480; c=relaxed/simple; bh=65hLud4xlt0PSN39xEJGmWh4I05LS0DbSyl9tYyByJo=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=HHh2vnfhvWHMRybyf/bIjbhIzglXtoZ8gaWBORz1hWn1LG5fSpnzwMe3lZZvYfNByJV6ZOhwVzNG4S9wqgrYz+hGrS7y9dCFLCC2XMilA59dV1qyjIADXw999SWT6mun9lCg3JAH0KQOU8RrT1zN+9IDD9QW1dv45hg8c7xhWmw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=nxozh7iJ; arc=none smtp.client-ip=95.215.58.180 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="nxozh7iJ" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1776761474; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=e5SgX+YVafdn2U1XYnpSWmBJ2zn5M8P1GrVlF6dB2uo=; b=nxozh7iJhH0uYNAXFWM6wRe3FVGgAOfJ2tTWLn4SmSNO7SRk61ymFb3phZSg4iZBL1cRPH S6ynxJNRzbGOhxmHPbSkq3LRAET6b34F9DWN8A+RgPZ5rJhT4FigS1RejJrlGSPZPul1a8 qcOOwzdT/p4NOySUSELC2w2xxZDNIVc= From: Ye Liu To: Andrew Morton , David Hildenbrand , "Liam R. Howlett" , Lorenzo Stoakes Cc: Ye Liu , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Kairui Song , Qi Zheng , Shakeel Butt , Barry Song , Axel Rasmussen , Yuanchu Xie , Wei Xu , Jann Horn , linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH] mm: handle potential NULL return from anon_vma_name_reuse() Date: Tue, 21 Apr 2026 16:50:55 +0800 Message-ID: <20260421085056.26033-1-ye.liu@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Migadu-Flow: FLOW_OUT From: Ye Liu The anon_vma_name_reuse() function may return NULL if memory allocation fails in anon_vma_name_alloc(). Currently, callers dup_anon_vma_name() and replace_anon_vma_name() do not check the return value, which could lead to NULL pointer dereferences. This patch adds proper error handling: - In dup_anon_vma_name(), if anon_vma_name_reuse() returns NULL, emit a warning via WARN_ON_ONCE(1) since this is an unexpected condition. - In replace_anon_vma_name(), return -ENOMEM to propagate the allocation failure to the caller. These changes improve robustness against memory allocation failures. Signed-off-by: Ye Liu --- include/linux/mm_inline.h | 12 +++++++++--- mm/madvise.c | 7 ++++++- 2 files changed, 15 insertions(+), 4 deletions(-) diff --git a/include/linux/mm_inline.h b/include/linux/mm_inline.h index a171070e15f0..9bbaf8287806 100644 --- a/include/linux/mm_inline.h +++ b/include/linux/mm_inline.h @@ -421,9 +421,15 @@ static inline void dup_anon_vma_name(struct vm_area_struct *orig_vma, struct vm_area_struct *new_vma) { struct anon_vma_name *anon_name = anon_vma_name(orig_vma); - - if (anon_name) - new_vma->anon_name = anon_vma_name_reuse(anon_name); + struct anon_vma_name *new_name; + + if (anon_name) { + new_name = anon_vma_name_reuse(anon_name); + if (new_name) + new_vma->anon_name = new_name; + else + WARN_ON_ONCE(1); + } } static inline void free_anon_vma_name(struct vm_area_struct *vma) diff --git a/mm/madvise.c b/mm/madvise.c index 69708e953cf5..ccb937a37e70 100644 --- a/mm/madvise.c +++ b/mm/madvise.c @@ -118,6 +118,7 @@ static int replace_anon_vma_name(struct vm_area_struct *vma, struct anon_vma_name *anon_name) { struct anon_vma_name *orig_name = anon_vma_name(vma); + struct anon_vma_name *new_name; if (!anon_name) { vma->anon_name = NULL; @@ -128,7 +129,11 @@ static int replace_anon_vma_name(struct vm_area_struct *vma, if (anon_vma_name_eq(orig_name, anon_name)) return 0; - vma->anon_name = anon_vma_name_reuse(anon_name); + new_name = anon_vma_name_reuse(anon_name); + if (!new_name) + return -ENOMEM; + + vma->anon_name = new_name; anon_vma_name_put(orig_name); return 0; -- 2.43.0