[PATCH 4/5] riscv: mm: Fix NULL dereferences in napot hugetlb functions

[David Hildenbrand (Arm)]

On 4/9/26 11:11, Michael Neuling wrote:
> huge_pte_offset() can return NULL when any level of the page table walk
> encounters a non-present entry. Both huge_ptep_set_access_flags() and
> huge_ptep_set_wrprotect() re-derive ptep via huge_pte_offset() in the
> napot path but use the result without a NULL check, leading to NULL
> pointer dereferences in get_clear_contig_flush() and set_pte_at().
> 
> Add NULL checks after huge_pte_offset() in both functions.
> 
> Fixes: 82a1a1f3bf ("riscv: mm: support Svnapot in hugetlb page")
> Signed-off-by: Michael Neuling <mikey at neuling.org>
> Assisted-by: Cursor:claude-4.6-opus-high-thinking
> ---
>  arch/riscv/mm/hugetlbpage.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/arch/riscv/mm/hugetlbpage.c b/arch/riscv/mm/hugetlbpage.c
> index a6d217112c..7d155341cf 100644
> --- a/arch/riscv/mm/hugetlbpage.c
> +++ b/arch/riscv/mm/hugetlbpage.c
> @@ -288,6 +288,8 @@ int huge_ptep_set_access_flags(struct vm_area_struct *vma,
>  	order = napot_cont_order(pte);
>  	pte_num = napot_pte_num(order);
>  	ptep = huge_pte_offset(mm, addr, napot_cont_size(order));
> +	if (!ptep)
> +		return 0;
>  	orig_pte = get_clear_contig_flush(mm, addr, ptep, pte_num);
>  
>  	if (pte_dirty(orig_pte))
> @@ -335,6 +337,8 @@ void huge_ptep_set_wrprotect(struct mm_struct *mm,
>  	order = napot_cont_order(pte);
>  	pte_num = napot_pte_num(order);
>  	ptep = huge_pte_offset(mm, addr, napot_cont_size(order));
> +	if (!ptep)
> +		return;
>  	orig_pte = get_clear_contig_flush(mm, addr, ptep, pte_num);
>  
>  	orig_pte = pte_wrprotect(orig_pte);


These functions are called when we previously verified that there is
indeed a pte mapped. And while holding the PTL to protect concurrent
unmapping.

So how should this possibly trigger?

-- 
Cheers,

David