FAILED: patch "[PATCH] arm64: hugetlb: avoid potential NULL dereference" failed to apply to 4.9-stable tree

The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 027d0c7101f50cf03aeea9eebf484afd4920c8d3 Mon Sep 17 00:00:00 2001
From: Mark Rutland <[email protected]>
Date: Tue, 5 May 2020 13:59:30 +0100
Subject: [PATCH] arm64: hugetlb: avoid potential NULL dereference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The static analyzer in GCC 10 spotted that in huge_pte_alloc() we may pass a NULL pmdp into pte_alloc_map() when pmd_alloc() returns NULL:

|   CC      arch/arm64/mm/pageattr.o
|   CC      arch/arm64/mm/hugetlbpage.o
|                  from arch/arm64/mm/hugetlbpage.c:10:
| arch/arm64/mm/hugetlbpage.c: In function ‘huge_pte_alloc’:
| ./arch/arm64/include/asm/pgtable-types.h:28:24: warning: dereference of NULL ‘pmdp’ [CWE-690] [-Wanalyzer-null-dereference]
| ./arch/arm64/include/asm/pgtable.h:436:26: note: in expansion of macro ‘pmd_val’
| arch/arm64/mm/hugetlbpage.c:242:10: note: in expansion of macro ‘pte_alloc_map’
|     |arch/arm64/mm/hugetlbpage.c:232:10:
|     |./arch/arm64/include/asm/pgtable-types.h:28:24:
| ./arch/arm64/include/asm/pgtable.h:436:26: note: in expansion of macro ‘pmd_val’
| arch/arm64/mm/hugetlbpage.c:242:10: note: in expansion of macro ‘pte_alloc_map’

This can only occur when the kernel cannot allocate a page, and so is unlikely to happen in practice before other systems start failing.

We can avoid this by bailing out if pmd_alloc() fails, as we do earlier in the function if pud_alloc() fails.

Fixes 66b3923a1a0f ("arm64: hugetlb: add support for PTE contiguous bit")

Signed-off-by Mark Rutland <[email protected]>

Reported-by Kyrill Tkachov <[email protected]>

Cc <[email protected]> # 4.5.x-

Cc Will Deacon <[email protected]>

Signed-off-by Catalin Marinas <[email protected]>

arch/arm64/mm/hugetlbpage.c +0 -0

index bbeb6a5a6ba6..0be3355e3499 100644

Quoted 55 lines · On Tue, 12 May 2020 at 16:56, <[email protected]> wrote:

The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 027d0c7101f50cf03aeea9eebf484afd4920c8d3 Mon Sep 17 00:00:00 2001
From: Mark Rutland <[email protected]>
Date: Tue, 5 May 2020 13:59:30 +0100
Subject: [PATCH] arm64: hugetlb: avoid potential NULL dereference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The static analyzer in GCC 10 spotted that in huge_pte_alloc() we may pass a NULL pmdp into pte_alloc_map() when pmd_alloc() returns NULL:

|   CC      arch/arm64/mm/pageattr.o
|   CC      arch/arm64/mm/hugetlbpage.o
|                  from arch/arm64/mm/hugetlbpage.c:10:
| arch/arm64/mm/hugetlbpage.c: In function ‘huge_pte_alloc’:
| ./arch/arm64/include/asm/pgtable-types.h:28:24: warning: dereference of NULL ‘pmdp’ [CWE-690] [-Wanalyzer-null-dereference]
| ./arch/arm64/include/asm/pgtable.h:436:26: note: in expansion of macro ‘pmd_val’
| arch/arm64/mm/hugetlbpage.c:242:10: note: in expansion of macro ‘pte_alloc_map’
|     |arch/arm64/mm/hugetlbpage.c:232:10:
|     |./arch/arm64/include/asm/pgtable-types.h:28:24:
| ./arch/arm64/include/asm/pgtable.h:436:26: note: in expansion of macro ‘pmd_val’
| arch/arm64/mm/hugetlbpage.c:242:10: note: in expansion of macro ‘pte_alloc_map’

This can only occur when the kernel cannot allocate a page, and so is unlikely to happen in practice before other systems start failing.

We can avoid this by bailing out if pmd_alloc() fails, as we do earlier in the function if pud_alloc() fails.

Fixes 66b3923a1a0f ("arm64: hugetlb: add support for PTE contiguous bit")

Signed-off-by Mark Rutland <[email protected]>

Reported-by Kyrill Tkachov <[email protected]>

Cc <[email protected]> # 4.5.x-

Cc Will Deacon <[email protected]>

Signed-off-by Catalin Marinas <[email protected]>

arch/arm64/mm/hugetlbpage.c +0 -0

index bbeb6a5a6ba6..0be3355e3499 100644

arch/arm64/mm/hugetlbpage.c pte_t *huge_pte_alloc(struct mm_struct *mm, · line 237

Quoted 8 lines

arch/arm64/mm/hugetlbpage.c +2 -0

@@ -230,6 +230,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                ptep = (pte_t *)pudp;
        } else if (sz == (CONT_PTE_SIZE)) {
                pmdp = pmd_alloc(mm, pudp, addr);
+               if (!pmdp)
+                       return NULL;
 
                WARN_ON(addr & (sz - 1));
                /*

on stable-rc 4.9 branch arm64 architecture build failed.

CC arch/arm64/mm/hugetlbpage.o
arch/arm64/mm/hugetlbpage.c: In function 'huge_pte_alloc':
arch/arm64/mm/hugetlbpage.c:106:8: error: 'pmdp' undeclared (first use in this function); did you mean 'pmd'?
if (!pmdp)

        ^~~~
        pmd

arch/arm64/mm/hugetlbpage.c:106:8: note: each undeclared identifier is reported only once for each function it appears in scripts/Makefile.build:304: recipe for target 'arch/arm64/mm/hugetlbpage.o' failed

ref:
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-4.9/DISTRO=lkft,MACHINE=hikey,label=docker-lkft/893/consoleText

Signature · 2 lines

Linaro LKFT
https://lkft.linaro.org

[+Sasha, as I think he did the backport]

Quoted 81 lines · Naresh Kamboju

Quoted 55 lines · On Tue, 12 May 2020 at 16:56, <[email protected]> wrote:

The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 027d0c7101f50cf03aeea9eebf484afd4920c8d3 Mon Sep 17 00:00:00 2001
From: Mark Rutland <[email protected]>
Date: Tue, 5 May 2020 13:59:30 +0100
Subject: [PATCH] arm64: hugetlb: avoid potential NULL dereference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The static analyzer in GCC 10 spotted that in huge_pte_alloc() we may pass a NULL pmdp into pte_alloc_map() when pmd_alloc() returns NULL:

|   CC      arch/arm64/mm/pageattr.o
|   CC      arch/arm64/mm/hugetlbpage.o
|                  from arch/arm64/mm/hugetlbpage.c:10:
| arch/arm64/mm/hugetlbpage.c: In function ‘huge_pte_alloc’:
| ./arch/arm64/include/asm/pgtable-types.h:28:24: warning: dereference of NULL ‘pmdp’ [CWE-690] [-Wanalyzer-null-dereference]
| ./arch/arm64/include/asm/pgtable.h:436:26: note: in expansion of macro ‘pmd_val’
| arch/arm64/mm/hugetlbpage.c:242:10: note: in expansion of macro ‘pte_alloc_map’
|     |arch/arm64/mm/hugetlbpage.c:232:10:
|     |./arch/arm64/include/asm/pgtable-types.h:28:24:
| ./arch/arm64/include/asm/pgtable.h:436:26: note: in expansion of macro ‘pmd_val’
| arch/arm64/mm/hugetlbpage.c:242:10: note: in expansion of macro ‘pte_alloc_map’

This can only occur when the kernel cannot allocate a page, and so is unlikely to happen in practice before other systems start failing.

We can avoid this by bailing out if pmd_alloc() fails, as we do earlier in the function if pud_alloc() fails.

Fixes 66b3923a1a0f ("arm64: hugetlb: add support for PTE contiguous bit")

Signed-off-by Mark Rutland <[email protected]>

Reported-by Kyrill Tkachov <[email protected]>

Cc <[email protected]> # 4.5.x-

Cc Will Deacon <[email protected]>

Signed-off-by Catalin Marinas <[email protected]>

arch/arm64/mm/hugetlbpage.c +0 -0

index bbeb6a5a6ba6..0be3355e3499 100644

arch/arm64/mm/hugetlbpage.c pte_t *huge_pte_alloc(struct mm_struct *mm, · line 237

Quoted 8 lines

arch/arm64/mm/hugetlbpage.c +2 -0

@@ -230,6 +230,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                ptep = (pte_t *)pudp;
        } else if (sz == (CONT_PTE_SIZE)) {
                pmdp = pmd_alloc(mm, pudp, addr);
+               if (!pmdp)
+                       return NULL;
 
                WARN_ON(addr & (sz - 1));
                /*

on stable-rc 4.9 branch arm64 architecture build failed.

CC arch/arm64/mm/hugetlbpage.o
arch/arm64/mm/hugetlbpage.c: In function 'huge_pte_alloc':
arch/arm64/mm/hugetlbpage.c:106:8: error: 'pmdp' undeclared (first use in this function); did you mean 'pmd'?
if (!pmdp)

        ^~~~
        pmd

arch/arm64/mm/hugetlbpage.c:106:8: note: each undeclared identifier is reported only once for each function it appears in scripts/Makefile.build:304: recipe for target 'arch/arm64/mm/hugetlbpage.o' failed

ref:
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-4.9/DISTRO=lkft,MACHINE=hikey,label=docker-lkft/893/consoleText

Quoted 82 lines · Will Deacon

[+Sasha, as I think he did the backport]

Quoted 79 lines · Naresh Kamboju

Quoted 55 lines · On Tue, 12 May 2020 at 16:56, <[email protected]> wrote:

The patch below does not apply to the 4.9-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 027d0c7101f50cf03aeea9eebf484afd4920c8d3 Mon Sep 17 00:00:00 2001
From: Mark Rutland <[email protected]>
Date: Tue, 5 May 2020 13:59:30 +0100
Subject: [PATCH] arm64: hugetlb: avoid potential NULL dereference
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The static analyzer in GCC 10 spotted that in huge_pte_alloc() we may pass a NULL pmdp into pte_alloc_map() when pmd_alloc() returns NULL:

|   CC      arch/arm64/mm/pageattr.o
|   CC      arch/arm64/mm/hugetlbpage.o
|                  from arch/arm64/mm/hugetlbpage.c:10:
| arch/arm64/mm/hugetlbpage.c: In function ‘huge_pte_alloc’:
| ./arch/arm64/include/asm/pgtable-types.h:28:24: warning: dereference of NULL ‘pmdp’ [CWE-690] [-Wanalyzer-null-dereference]
| ./arch/arm64/include/asm/pgtable.h:436:26: note: in expansion of macro ‘pmd_val’
| arch/arm64/mm/hugetlbpage.c:242:10: note: in expansion of macro ‘pte_alloc_map’
|     |arch/arm64/mm/hugetlbpage.c:232:10:
|     |./arch/arm64/include/asm/pgtable-types.h:28:24:
| ./arch/arm64/include/asm/pgtable.h:436:26: note: in expansion of macro ‘pmd_val’
| arch/arm64/mm/hugetlbpage.c:242:10: note: in expansion of macro ‘pte_alloc_map’

This can only occur when the kernel cannot allocate a page, and so is unlikely to happen in practice before other systems start failing.

We can avoid this by bailing out if pmd_alloc() fails, as we do earlier in the function if pud_alloc() fails.

Fixes 66b3923a1a0f ("arm64: hugetlb: add support for PTE contiguous bit")

Signed-off-by Mark Rutland <[email protected]>

Reported-by Kyrill Tkachov <[email protected]>

Cc <[email protected]> # 4.5.x-

Cc Will Deacon <[email protected]>

Signed-off-by Catalin Marinas <[email protected]>

arch/arm64/mm/hugetlbpage.c +0 -0

index bbeb6a5a6ba6..0be3355e3499 100644

arch/arm64/mm/hugetlbpage.c pte_t *huge_pte_alloc(struct mm_struct *mm, · line 237

Quoted 8 lines

arch/arm64/mm/hugetlbpage.c +2 -0

@@ -230,6 +230,8 @@ pte_t *huge_pte_alloc(struct mm_struct *mm,
                ptep = (pte_t *)pudp;
        } else if (sz == (CONT_PTE_SIZE)) {
                pmdp = pmd_alloc(mm, pudp, addr);
+               if (!pmdp)
+                       return NULL;
 
                WARN_ON(addr & (sz - 1));
                /*

on stable-rc 4.9 branch arm64 architecture build failed.

CC arch/arm64/mm/hugetlbpage.o
arch/arm64/mm/hugetlbpage.c: In function 'huge_pte_alloc':
arch/arm64/mm/hugetlbpage.c:106:8: error: 'pmdp' undeclared (first use in this function); did you mean 'pmd'?
if (!pmdp)

        ^~~~
        pmd

arch/arm64/mm/hugetlbpage.c:106:8: note: each undeclared identifier is reported only once for each function it appears in scripts/Makefile.build:304: recipe for target 'arch/arm64/mm/hugetlbpage.o' failed

Quoted 2 lines

Quoted 2 lines

ref:
https://ci.linaro.org/view/lkft/job/openembedded-lkft-linux-stable-rc-4.9/DISTRO=lkft,MACHINE=hikey,label=docker-lkft/893/consoleText

Now dropped from 4.9 as well.