| Message ID | 20220727064621.534528-1-liuyongqiang13@huawei.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | mm/folio-compact: fix potential NULL pointer in pagecache_get_page | expand |
This isn't a NULL pointer dereference; returning &(0->page) is completely legal as was discussed regarding this exact code back in April: https://lore.kernel.org/lkml/YmfgqKcMmstgfz+0@casper.infradead.org/ > On Jul 27, 2022, at 12:46 AM, Yongqiang Liu <liuyongqiang13@huawei.com> wrote: > > When __filemap_get_folio() failed and returned NULL, we would > get a NULL pointer dereference in pagecache_get_page. > > Fixes: 3f0c6a07fee6 ("mm/filemap: Add filemap_get_folio") > Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com> > Cc: <stable@vger.kernel.org> # 5.16 > --- > mm/folio-compat.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/mm/folio-compat.c b/mm/folio-compat.c > index 20bc15b57d93..7b21393480e0 100644 > --- a/mm/folio-compat.c > +++ b/mm/folio-compat.c > @@ -124,7 +124,9 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t index, > struct folio *folio; > > folio = __filemap_get_folio(mapping, index, fgp_flags, gfp); > - if ((fgp_flags & FGP_HEAD) || !folio || xa_is_value(folio)) > + if (!folio) > + return NULL; > + if ((fgp_flags & FGP_HEAD) || xa_is_value(folio)) > return &folio->page; > return folio_file_page(folio, index); > } > -- > 2.25.1 > >
On Wed, Jul 27, 2022 at 06:46:21AM +0000, Yongqiang Liu wrote: > When __filemap_get_folio() failed and returned NULL, we would > get a NULL pointer dereference in pagecache_get_page. No we wouldn't.
Understood, thanks for your explanation :) 在 2022/7/27 19:40, William Kucharski 写道: > This isn't a NULL pointer dereference; returning &(0->page) is completely legal > as was discussed regarding this exact code back in April: > > https://lore.kernel.org/lkml/YmfgqKcMmstgfz+0@casper.infradead.org/ > >> On Jul 27, 2022, at 12:46 AM, Yongqiang Liu <liuyongqiang13@huawei.com> wrote: >> >> When __filemap_get_folio() failed and returned NULL, we would >> get a NULL pointer dereference in pagecache_get_page. >> >> Fixes: 3f0c6a07fee6 ("mm/filemap: Add filemap_get_folio") >> Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com> >> Cc: <stable@vger.kernel.org> # 5.16 >> --- >> mm/folio-compat.c | 4 +++- >> 1 file changed, 3 insertions(+), 1 deletion(-) >> >> diff --git a/mm/folio-compat.c b/mm/folio-compat.c >> index 20bc15b57d93..7b21393480e0 100644 >> --- a/mm/folio-compat.c >> +++ b/mm/folio-compat.c >> @@ -124,7 +124,9 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t index, >> struct folio *folio; >> >> folio = __filemap_get_folio(mapping, index, fgp_flags, gfp); >> - if ((fgp_flags & FGP_HEAD) || !folio || xa_is_value(folio)) >> + if (!folio) >> + return NULL; >> + if ((fgp_flags & FGP_HEAD) || xa_is_value(folio)) >> return &folio->page; >> return folio_file_page(folio, index); >> } >> -- >> 2.25.1 >> >> > .
diff --git a/mm/folio-compat.c b/mm/folio-compat.c index 20bc15b57d93..7b21393480e0 100644 --- a/mm/folio-compat.c +++ b/mm/folio-compat.c @@ -124,7 +124,9 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t index, struct folio *folio; folio = __filemap_get_folio(mapping, index, fgp_flags, gfp); - if ((fgp_flags & FGP_HEAD) || !folio || xa_is_value(folio)) + if (!folio) + return NULL; + if ((fgp_flags & FGP_HEAD) || xa_is_value(folio)) return &folio->page; return folio_file_page(folio, index); }
When __filemap_get_folio() failed and returned NULL, we would get a NULL pointer dereference in pagecache_get_page. Fixes: 3f0c6a07fee6 ("mm/filemap: Add filemap_get_folio") Signed-off-by: Yongqiang Liu <liuyongqiang13@huawei.com> Cc: <stable@vger.kernel.org> # 5.16 --- mm/folio-compat.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)