[android-common:android17-6.18 32/32] fs/fuse/file.c:959 fuse_readpages_end() warn: variable dereferenced before check 'mapping' (see line 944)

tree:   https://android.googlesource.com/kernel/common android17-6.18
head:   5c36f73a41f1533cae407eba882ca2940e1775f1
commit: be926e6761d28d105ba672242e81e911e0d7e5e0 [32/32] ANDROID: fuse-bpf: fuse-bpf v1.3
config: x86_64-randconfig-161 (https://download.01.org/0day-ci/archive/20260819/[email protected]/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9187-g5189e3fb

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

smatch warnings:
fs/fuse/file.c:959 fuse_readpages_end() warn: variable dereferenced before check 'mapping' (see line 944)

vim +/mapping +959 fs/fuse/file.c

fcee216beb9c15c Max Reitz        2020-05-06  931  static void fuse_readpages_end(struct fuse_mount *fm, struct fuse_args *args,
134831e36bbdd6c Miklos Szeredi   2019-09-10  932  			       int err)
db50b96c0f28a21 Miklos Szeredi   2005-09-09  933  {
c1aa96a52e9594f Miklos Szeredi   2006-01-16  934  	int i;
134831e36bbdd6c Miklos Szeredi   2019-09-10  935  	struct fuse_io_args *ia = container_of(args, typeof(*ia), ap.args);
134831e36bbdd6c Miklos Szeredi   2019-09-10  936  	struct fuse_args_pages *ap = &ia->ap;
134831e36bbdd6c Miklos Szeredi   2019-09-10  937  	size_t count = ia->read.in.size;
134831e36bbdd6c Miklos Szeredi   2019-09-10  938  	size_t num_read = args->out_args[0].size;
02d47e213dce6e2 Joanne Koong     2025-08-29  939  	struct address_space *mapping;
02d47e213dce6e2 Joanne Koong     2025-08-29  940  	struct inode *inode;
ce534fb052928ce Miklos Szeredi   2010-05-25  941  
02d47e213dce6e2 Joanne Koong     2025-08-29  942  	WARN_ON_ONCE(!ap->num_folios);
02d47e213dce6e2 Joanne Koong     2025-08-29  943  	mapping = ap->folios[0]->mapping;
02d47e213dce6e2 Joanne Koong     2025-08-29 @944  	inode = mapping->host;
                                                                ^^^^^^^^^^^^^
Dereferenced

c1aa96a52e9594f Miklos Szeredi   2006-01-16  945  
5c5c5e51b26413d Miklos Szeredi   2008-04-30  946  	/*
5c5c5e51b26413d Miklos Szeredi   2008-04-30  947  	 * Short read means EOF. If file size is larger, truncate it
5c5c5e51b26413d Miklos Szeredi   2008-04-30  948  	 */
134831e36bbdd6c Miklos Szeredi   2019-09-10  949  	if (!err && num_read < count)
134831e36bbdd6c Miklos Szeredi   2019-09-10  950  		fuse_short_read(inode, ia->read.attr_ver, num_read, ap);
5c5c5e51b26413d Miklos Szeredi   2008-04-30  951  
451418fc928b5ec Andrew Gallagher 2013-11-05  952  	fuse_invalidate_atime(inode);
c1aa96a52e9594f Miklos Szeredi   2006-01-16  953  
0c67c37e1710b2a Joanne Koong     2025-02-11  954  	for (i = 0; i < ap->num_folios; i++) {
51b025301824f16 Joanne Koong     2024-10-24  955  		folio_end_read(ap->folios[i], !err);
0c67c37e1710b2a Joanne Koong     2025-02-11  956  		folio_put(ap->folios[i]);
0c67c37e1710b2a Joanne Koong     2025-02-11  957  	}
134831e36bbdd6c Miklos Szeredi   2019-09-10  958  	if (ia->ff)
be926e6761d28d1 Paul Lawrence    2021-12-02 @959  		fuse_file_put(mapping ? mapping->host : NULL, ia->ff, false);
                                                                              ^^^^^^^
Checked too late.

134831e36bbdd6c Miklos Szeredi   2019-09-10  960  
134831e36bbdd6c Miklos Szeredi   2019-09-10  961  	fuse_io_free(ia);
c1aa96a52e9594f Miklos Szeredi   2006-01-16  962  }

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki