smatch warning in mm/mmap.c

PATCH New Dan Carpenter 2 participants 2 messages Apr 26, 2010

Subsystems (2)

Memory management Memory mapping

lore

Share & tools

lore

Dan Carpenter

author

2010-04-26 10:03 UTC #0 lore raw

Hi Rik,

This code generates a Smatch warning. I normally ignore Smatch warnings in mm because I'm not clever enough to mess with that, but this one is pretty recent so I thought I'd ask. Could you take a look?

mm/mmap.c +1980 __split_vma(57) error: we previously assumed 'new->vm_ops' could be null.
1966 if (new->vm_ops && new->vm_ops->open)

                    ^^^^^^^^^^^
	We assume new->vm_ops can be NULL here.

  1967                  new->vm_ops->open(new);
  1968
  1969          if (new_below)
  1970                  err = vma_adjust(vma, addr, vma->vm_end, vma->vm_pgoff +
  1971                          ((addr - new->vm_start) >> PAGE_SHIFT), new);
  1972          else
  1973                  err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  1974
  1975          /* Success. */
  1976          if (!err)
  1977                  return 0;
  1978
  1979          /* Clean everything up if vma_adjust failed. */
  1980          new->vm_ops->close(new);
                ^^^^^^^^^^^^^^^^^^

But we dereference it unconditionally here.

The dereference was added in 5beb4930: "mm: change anon_vma linking to fix multi-process server scalability issue".

regards,
dan carpenter

--
To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to [email protected]. For more info on Linux MM,
see: http://www.linux-mm.org/ .
Don't email: <a href=mailto:"[email protected]"> [email protected] </a>

Rik van Riel

2010-04-26 16:59 UTC #1 lore raw

PATCH 1/1 mmap: check ->vm_ops before dereferencing

Check whether the VMA has a vm_ops before calling close, just like we check vm_ops before calling open a few dozen lines higher up in the function.

Signed-off-by Rik van Riel <[email protected]>

Reported-by Dan Carpenter <[email protected]>

mm/mmap.c +2 -1

index f90ea92..456ec6f 100644
@@ -1977,7 +1977,8 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
 		return 0;
 
 	/* Clean everything up if vma_adjust failed. */
-	new->vm_ops->close(new);
+	if (new->vm_ops && new->vm_ops->close)
+		new->vm_ops->close(new);
 	if (new->vm_file) {
 		if (vma->vm_flags & VM_EXECUTABLE)
 			removed_exe_file_vma(mm);