From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [akpm-mm:mm-unstable 381/400] mm/madvise.c:1001 madvise_collapse() warn: variable dereferenced before check 'vma' (see line 969)
Date: Sat, 12 Sep 2026 16:22:13 +0200 [thread overview]
Message-ID: <202609121604.osnEA06x-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: David Hildenbrand <david@kernel.org>
CC: Andrew Morton <akpm@linux-foundation.org>
CC: Linux Memory Management List <linux-mm@kvack.org>
CC: mm-commits@vger.kernel.org
TO: "Kiryl Shutsemau (Meta)" <kas@kernel.org>
CC: Andrew Morton <akpm@linux-foundation.org>
CC: Linux Memory Management List <linux-mm@kvack.org>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable
head: e2e54005e20fb42d4a5e140d70a65be4a2363045
commit: 68911e99c4afb4ec69928136adfb19077c6f9b31 [381/400] mm/collapse: implement MADV_COLLAPSE in madvise.c
:::::: branch date: 6 hours ago
:::::: commit date: 6 hours ago
config: riscv-randconfig-r073-20260912 (https://download.01.org/0day-ci/archive/20260912/202609121604.osnEA06x-lkp@intel.com/config)
compiler: clang version 24.0.0git (https://github.com/llvm/llvm-project 707c032dae3bee24eae29c6f4c459a6d6dc6556d)
rustc: rustc 1.96.0 (ac68faa20 2026-05-25)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202609121604.osnEA06x-lkp@intel.com/
smatch warnings:
mm/madvise.c:1001 madvise_collapse() warn: variable dereferenced before check 'vma' (see line 969)
vim +/vma +1001 mm/madvise.c
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 958)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 959) static int madvise_collapse(struct madvise_behavior *madv_behavior)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 960) {
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 961) struct madvise_behavior_range *range = &madv_behavior->range;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 962) struct vm_area_struct *vma = madv_behavior->vma;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 963) struct mm_struct *mm = madv_behavior->mm;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 964) struct collapse_control *cc;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 965) unsigned long hstart, hend, addr, orders;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 966) enum scan_result last_fail = SCAN_FAIL;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 967) int thps = 0;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 968)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 @969) BUG_ON(vma->vm_start > range->start);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 970) BUG_ON(vma->vm_end < range->end);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 971)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 972) orders = collapse_possible_orders(vma, vma->vm_flags,
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 973) TVA_FORCED_COLLAPSE);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 974) if (!orders)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 975) return -EINVAL;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 976)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 977) hstart = ALIGN(range->start, HPAGE_PMD_SIZE);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 978) hend = ALIGN_DOWN(range->end, HPAGE_PMD_SIZE);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 979)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 980) if (hstart >= hend)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 981) return 0;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 982)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 983) cc = kmalloc_obj(*cc);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 984) if (!cc)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 985) return -ENOMEM;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 986) collapse_control_init(cc);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 987) collapse_policy_forced(&cc->policy);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 988)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 989) lru_add_drain_all();
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 990)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 991) for (addr = hstart; addr < hend; addr += HPAGE_PMD_SIZE) {
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 992) struct vm_area_struct *found;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 993) enum scan_result result;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 994)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 995) /*
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 996) * A collapse gives the lock up, so the VMA has to be found
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 997) * again after one: it can shrink while nothing is held. A scan
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 998) * that finds nothing to collapse leaves the lock alone, so a
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 999) * range that is already collapsed walks on without relocking.
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1000) */
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 @1001) if (!vma) {
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1002) cond_resched();
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1003) mmap_read_lock(mm);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1004) result = collapse_vma_revalidate(mm, addr, false, &found,
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1005) cc, HPAGE_PMD_ORDER);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1006) if (result != SCAN_SUCCEED) {
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1007) last_fail = result;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1008) goto out_locked;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1009) }
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1010) vma = found;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1011) hend = min(hend, vma->vm_end & HPAGE_PMD_MASK);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1012) orders = collapse_possible_orders(vma, vma->vm_flags,
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1013) cc->policy.tva_type);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1014) }
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1015)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1016) result = collapse_scan_pmd(vma, addr, cc, orders);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1017) /* Nothing to collapse here, and the lock is still ours */
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1018) if (result != SCAN_SUCCEED)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1019) goto tally;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1020)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1021) /* The collapse takes its own locks, so give this up */
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1022) mmap_read_unlock(mm);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1023) mark_mmap_lock_dropped(madv_behavior);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1024) vma = NULL;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1025)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1026) result = collapse_run_pmd(mm, addr, cc);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1027) tally:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1028) switch (result) {
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1029) case SCAN_SUCCEED:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1030) case SCAN_PMD_MAPPED:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1031) ++thps;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1032) break;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1033) /* Whitelisted set of results where continuing OK */
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1034) case SCAN_NO_PTE_TABLE:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1035) case SCAN_PTE_NON_PRESENT:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1036) case SCAN_PTE_UFFD:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1037) case SCAN_LACK_REFERENCED_PAGE:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1038) case SCAN_PAGE_NULL:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1039) case SCAN_PAGE_COUNT:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1040) case SCAN_PAGE_LOCK:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1041) case SCAN_PAGE_COMPOUND:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1042) case SCAN_PAGE_LRU:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1043) case SCAN_DEL_PAGE_LRU:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1044) last_fail = result;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1045) break;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1046) default:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1047) last_fail = result;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1048) /* Other error, exit */
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1049) goto out;
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1050) }
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1051) }
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1052)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1053) out:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1054) /* Caller expects us to hold mmap_lock on return */
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1055) if (!vma)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1056) mmap_read_lock(mm);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1057) out_locked:
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1058) mmap_assert_locked(mm);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1059) collapse_control_release(cc);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1060) kfree(cc);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1061)
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1062) return thps == ((hend - hstart) >> HPAGE_PMD_SHIFT) ? 0
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1063) : madvise_collapse_errno(last_fail);
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1064) }
68911e99c4afb4 Kiryl Shutsemau (Meta 2026-09-10 1065)
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
reply other threads:[~2026-09-12 14:22 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202609121604.osnEA06x-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox