From nobody Mon Sep 28 05:46:25 2026 Received: from smtpbgau1.qq.com (smtpbgau1.qq.com [54.206.16.166]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2908C191F94 for ; Wed, 26 Aug 2026 06:32:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=54.206.16.166 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787725962; cv=none; b=HJd2LCvguhrylEAaX+HX7hJ0H3TnCObv/c5Ksk7tTPVi9vzKJlto8SzBFrW1hBhu6mHf55LIP1/qAMojQyk7ar2tDG10TVeXOoAAudbLW5GMr40rRVcCBw7SuZ7x4cZE05BHT12NrjEa87vZjWNjLpnuOs+0ahT+OLUAMCpiWqk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787725962; c=relaxed/simple; bh=upLjFfbUbpWALtJpvj3vGLdYzZiidNDCYMOehZpnaX8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=bbFxgqZNSTou+h3bTZaFE2ubV6weMMWcSQuvHUCmgLgb7gcIQwBEvtzipioou811yrP5krMu6jfCGxKb022BuMKr3XEq8r7x6GrEnu4ZGf9ZoLtOfXlwneWCqQ/9bGm+Q2jL87UiiSxiPGl1c/Me0FE6S4PKyST8Kxw7oNBOmHs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinsec.com.cn; spf=pass smtp.mailfrom=kylinsec.com.cn; arc=none smtp.client-ip=54.206.16.166 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=kylinsec.com.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=kylinsec.com.cn X-QQ-mid: zesmtpgz1t1787725824ta8c5bcf2 X-QQ-Originating-IP: XoYHGViZHRkF8grjBFcf1wFtpnwvYS4ldql6RKskZoQ= Received: from localhost.localdomain ( [111.8.45.130]) by bizesmtp.qq.com (ESMTP) with id ; Wed, 26 Aug 2026 14:30:20 +0800 (CST) X-QQ-SSF: 0000000000000000000000000000000 X-QQ-GoodBg: 0 X-BIZMAIL-ID: 4632055950645483182 EX-QQ-RecipientCnt: 11 From: Liu Dalin To: Andrew Morton , David Hildenbrand , Jason Gunthorpe Cc: John Hubbard , Peter Xu , linux-mm@kvack.org, linux-kernel@vger.kernel.org, Liu Dalin , Deng yingchao , Qin yungao , Luo Qiu Subject: [PATCH] mm/gup: add NULL check for unlocked parameter in fixup_user_fault() Date: Wed, 26 Aug 2026 14:29:43 +0800 Message-ID: X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-QQ-SENDSIZE: 520 Feedback-ID: zesmtpgz:kylinsec.com.cn:qybglogicsvrgz:qybglogicsvrgz6b-0 X-QQ-XMAILINFO: Mp7prxL8yJP4k5gyK46EuxCuVA3TArhryMDeu5pxaFJPioVUyfm0a2Iy jotp+CzwihW4MjVDSvbIRey5oLU7cqLP3nB+y3uY8Qhu6/LiJjhLaoZs7+7tQIvOgan5OGG GJoR+J7AW9VGh0aakuJTrQQIatP2Mbt5Vp17GWU0mC1QNgWsEuSw0o1HySVapzom8Ca1xjX DzCLbbxETh/ssCrsbGvX7arGhjksw2tg7G2DLaQ7kA/gNQOQovRhZ0tp4d/H4wqILeLs7lJ L4D9IX7VlpkjxZDCHaRKXMPdpSLyzYBri1vmEVY/JLrvrr9s2WpLtq0ahvXIE1mq6cJuhyH n/jH7HRVL2UTeBbyO1QJ5mKE5f9hasGw4X2glxvndBfqMjN6fKfLh5efqKqn4gzVWSCUWPn 3cWSePhVSGgavowXEacdWjHgJY4gn2UGGmO5GVyRf6YVr4vV9nKauV+gei+Mm5KyG2lRc/2 dUzwTV8sc3EQazdC5oZfu/4YTjyISRIvKupGV4uoT27DICZvUtPcCrv9/TckcRJYZH/pBKq LOHTrlCsAqMVNmnbNhj/I2Wpbb9pamJJbVh4MbFI7CyhPvaZuciU0nSv6gdoYxWxBqjmjPY 6VmlaKpipHIV/oway4WsYxIcCq9XdOTW55ojUTRCU0f9/2ZUOsynFpAoc70Po7g44woNZPt 8ZPTofgemPToo90GgZsCTGi3QanmvBNTKWJD5BAAhCmQGmjfJAiQqF0UQcYOeGPZQBy3j6m GtMifHB7xubPRGsgtNhgq+HRgz333H2XtjfwP6McIJoiLB1skmSlmpTgQxDQsAjeZguEjz3 FF95F81C00vokLqXsRamOysB51i9Ijg9SH2/y9DFfcqnx91Y9cUu9zFiuZkp1xcYLLdgF8E c5oWEF5BtzrFnBcjXd5LfrFdGxXhCpIq7ICAAeVu1k0Ekzv/QgtEEpg1m/FdDYyU1ppa2Uj NkTwRL2GP3qiwKPqAj9oC9M+TGJ6qMI6YJKgh4fJ/OsXD+n17pAiRQORI+chY1gcff9gZfE Nv2EwNJOe2x+xzoPTtrixpto6NI/6pF3RtOuQpZ5PbMDUMncDRGZX4f+Rme4c= X-QQ-XMRINFO: NyFYKkN4Ny6FuXrnB5Ye7Aabb3ujjtK+gg== X-QQ-RECHKSPAM: 0 Content-Type: text/plain; charset="utf-8" While the current callers either pass a valid pointer or explicitly pass NULL (indicating they don't need the unlock notification), it is safer to add a defensive NULL check before dereferencing. This prevents a kernel crash if any caller passes NULL and handle_mm_fault() returns VM_FAULT_COMPLETED or VM_FAULT_RETRY. Fixes smatch warnings: - mm/gup.c:1597 fixup_user_fault() error: we previously assumed 'unlocked' = could be null (see line 1573) Fixes: 4bbd4c776a63 ("mm: move get_user_pages()-related code to separate fi= le") Assisted-by: smatch:2.0 [static analysis] Signed-off-by: Liu Dalin --- mm/gup.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/mm/gup.c b/mm/gup.c index 0692119b7904..d12475a7f7cc 100644 --- a/mm/gup.c +++ b/mm/gup.c @@ -1594,7 +1594,8 @@ int fixup_user_fault(struct mm_struct *mm, * could tell the callers so they do not need to unlock. */ mmap_read_lock(mm); - *unlocked =3D true; + if (unlocked) + *unlocked =3D true; return 0; } =20 @@ -1608,7 +1609,8 @@ int fixup_user_fault(struct mm_struct *mm, =20 if (ret & VM_FAULT_RETRY) { mmap_read_lock(mm); - *unlocked =3D true; + if (unlocked) + *unlocked =3D true; fault_flags |=3D FAULT_FLAG_TRIED; goto retry; } --=20 2.43.0