Re: [bug report] mm, compaction: capture a page under direct compaction

[Vlastimil Babka <vbabka@suse.cz>]

On 2/24/20 7:35 AM, Dan Carpenter wrote:
> Hello Mel Gorman,
> 
> This is a semi-automatic email about new static checker warnings.
> 
> The patch 5e1f0f098b46: "mm, compaction: capture a page under direct 
> compaction" from Mar 5, 2019, leads to the following Smatch complaint:
> 
>     mm/compaction.c:2321 compact_zone_order()
>      error: we previously assumed 'capture' could be null (see line 2313)
> 

----8<----
From fb264bb52576a0582e8a92952cf91e8b61d105c3 Mon Sep 17 00:00:00 2001
From: Vlastimil Babka <vbabka@suse.cz>
Date: Wed, 26 Feb 2020 17:53:54 +0100
Subject: [PATCH] mm, compaction: fully assume capture can be NULL in
 compact_zone_order()

Dan reports:

The patch 5e1f0f098b46: "mm, compaction: capture a page under direct
compaction" from Mar 5, 2019, leads to the following Smatch complaint:

    mm/compaction.c:2321 compact_zone_order()
     error: we previously assumed 'capture' could be null (see line 2313)

mm/compaction.c
  2288  static enum compact_result compact_zone_order(struct zone *zone, int order,
  2289                  gfp_t gfp_mask, enum compact_priority prio,
  2290                  unsigned int alloc_flags, int classzone_idx,
  2291                  struct page **capture)
                                      ^^^^^^^

  2313		if (capture)
                    ^^^^^^^
Check for NULL

  2314			current->capture_control = &capc;
  2315
  2316		ret = compact_zone(&cc, &capc);
  2317
  2318		VM_BUG_ON(!list_empty(&cc.freepages));
  2319		VM_BUG_ON(!list_empty(&cc.migratepages));
  2320
  2321		*capture = capc.page;
                ^^^^^^^^
Unchecked dereference.

  2322		current->capture_control = NULL;
  2323

In practice this is not an issue, as the only caller path passes non-NULL
capture:

__alloc_pages_direct_compact()
  struct page *page = NULL;
  try_to_compact_pages(capture = &page);
    compact_zone_order(capture = capture);

Hence no stable tag needed, but let's make this more robust and remove the
warning by assuming capture might be NULL in the second dereference.

Fixes: 5e1f0f098b46 ("mm, compaction: capture a page under direct compaction")
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Mel Gorman <mgorman@techsingularity.net>
---
 mm/compaction.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git mm/compaction.c mm/compaction.c
index 672d3c78c6ab..f4bb8091cf4f 100644
--- mm/compaction.c
+++ mm/compaction.c
@@ -2318,8 +2318,10 @@ static enum compact_result compact_zone_order(struct zone *zone, int order,
 	VM_BUG_ON(!list_empty(&cc.freepages));
 	VM_BUG_ON(!list_empty(&cc.migratepages));
 
-	*capture = capc.page;
-	current->capture_control = NULL;
+	if (capture) {
+		*capture = capc.page;
+		current->capture_control = NULL;
+	}
 
 	return ret;
 }
-- 
2.25.1