[akpm-mm:mm-new 415/461] mm/hmm.c:672 hmm_do_fault() error: we previously assumed 'hmm_vma_walk->locked' could be null (see line 653)

BCC: [email protected]
CC: [email protected]
CC: David Hildenbrand <[email protected]>
CC: Andrew Morton <[email protected]>
CC: Linux Memory Management List <[email protected]>
CC: [email protected]
TO: Stanislav Kinsburskii <[email protected]>
CC: Andrew Morton <[email protected]>
CC: Linux Memory Management List <[email protected]>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-new
head:   61cccb8363fcc282d4ae0555b8739dd227f5ad0b
commit: cf5190133132cab57fb5f9ff881dddcaf748456b [415/461] mm/hmm: add hmm_range_fault_unlocked_timeout() for mmap lock-drop support
:::::: branch date: 19 hours ago
:::::: commit date: 19 hours ago
config: x86_64-randconfig-161-20260711 (https://download.01.org/0day-ci/archive/20260712/[email protected]/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9185-gbcc58b9c

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

smatch warnings:
mm/hmm.c:672 hmm_do_fault() error: we previously assumed 'hmm_vma_walk->locked' could be null (see line 653)

vim +672 mm/hmm.c

7b86ac3371b70c Christoph Hellwig     2019-08-28  632  
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  633  /*
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  634   * hmm_do_fault - fault in a range recorded by a walk callback
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  635   *
cf5190133132ca Stanislav Kinsburskii 2026-07-10  636   * Called from the outer loop in hmm_range_fault_locked() after a callback
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  637   * returned HMM_FAULT_PENDING.  At this point we hold only mmap_lock;
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  638   * the page-table spinlock and any hugetlb_vma_lock acquired by the walk
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  639   * framework have already been released by the unwind.
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  640   *
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  641   * Returns -EBUSY on success (all pages faulted, caller should re-walk).
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  642   * Returns a negative errno on failure.
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  643   */
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  644  static int hmm_do_fault(struct mm_struct *mm,
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  645  			struct hmm_vma_walk *hmm_vma_walk)
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  646  {
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  647  	unsigned long addr = hmm_vma_walk->last;
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  648  	unsigned long end = hmm_vma_walk->end;
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  649  	unsigned int required_fault = hmm_vma_walk->required_fault;
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  650  	unsigned int fault_flags = FAULT_FLAG_REMOTE;
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  651  	struct vm_area_struct *vma;
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  652  
cf5190133132ca Stanislav Kinsburskii 2026-07-10 @653  	if (hmm_vma_walk->locked)
cf5190133132ca Stanislav Kinsburskii 2026-07-10  654  		fault_flags |= FAULT_FLAG_ALLOW_RETRY | FAULT_FLAG_KILLABLE;
cf5190133132ca Stanislav Kinsburskii 2026-07-10  655  
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  656  	vma = vma_lookup(mm, addr);
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  657  	if (!vma)
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  658  		return -EFAULT;
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  659  
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  660  	if (required_fault & HMM_NEED_WRITE_FAULT) {
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  661  		if (!(vma->vm_flags & VM_WRITE))
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  662  			return -EPERM;
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  663  		fault_flags |= FAULT_FLAG_WRITE;
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  664  	}
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  665  
cf5190133132ca Stanislav Kinsburskii 2026-07-10  666  	for (; addr < end; addr += PAGE_SIZE) {
cf5190133132ca Stanislav Kinsburskii 2026-07-10  667  		vm_fault_t ret;
cf5190133132ca Stanislav Kinsburskii 2026-07-10  668  
cf5190133132ca Stanislav Kinsburskii 2026-07-10  669  		ret = handle_mm_fault(vma, addr, fault_flags, NULL);
cf5190133132ca Stanislav Kinsburskii 2026-07-10  670  
cf5190133132ca Stanislav Kinsburskii 2026-07-10  671  		if (ret & (VM_FAULT_COMPLETED | VM_FAULT_RETRY)) {
cf5190133132ca Stanislav Kinsburskii 2026-07-10 @672  			*hmm_vma_walk->locked = false;
cf5190133132ca Stanislav Kinsburskii 2026-07-10  673  			return HMM_FAULT_UNLOCKED;
cf5190133132ca Stanislav Kinsburskii 2026-07-10  674  		}
cf5190133132ca Stanislav Kinsburskii 2026-07-10  675  
cf5190133132ca Stanislav Kinsburskii 2026-07-10  676  		if (ret & VM_FAULT_ERROR) {
cf5190133132ca Stanislav Kinsburskii 2026-07-10  677  			int err = vm_fault_to_errno(ret, 0);
cf5190133132ca Stanislav Kinsburskii 2026-07-10  678  
cf5190133132ca Stanislav Kinsburskii 2026-07-10  679  			if (WARN_ON(!err))
cf5190133132ca Stanislav Kinsburskii 2026-07-10  680  				err = -EINVAL;
cf5190133132ca Stanislav Kinsburskii 2026-07-10  681  
cf5190133132ca Stanislav Kinsburskii 2026-07-10  682  			return err;
cf5190133132ca Stanislav Kinsburskii 2026-07-10  683  		}
cf5190133132ca Stanislav Kinsburskii 2026-07-10  684  	}
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  685  
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  686  	return -EBUSY;
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  687  }
c10ed1c5cb4ce2 Stanislav Kinsburskii 2026-07-10  688  

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki