[POSSIBLE BUG] Dereferencing of NULL pointer

[Rustam Subkhankulov <subkhankulov@xxxxxxxxx>]

Version: 6.0-rc1

Description: 

In function 'privcmd_ioctl_dm_op' (drivers/xen/privcmd.c: 615)return
value of 'kcalloc' with GFP_KERNEL flag is assigned to "pages"
variable. GFP_KERNEL flag does not guarantee, that the return value
will not be NULL. In that case, there is a jump to the "out" label. 

---------------------------------------------------------------------
667     pages = kcalloc(nr_pages, sizeof(*pages), GFP_KERNEL);
668     if (!pages) {
669             rc = -ENOMEM;
670             goto out;
671     }
---------------------------------------------------------------------

Variable 'pages' is passed to function 'unpin_user_pages_dirty_lock' as
1st parameter at [drivers/xen/privcmd.c: 695].

---------------------------------------------------------------------
694     out:
695             unlock_pages(pages, nr_pages);
---------------------------------------------------------------------

Then, variable 'pages' is passed to function
'unpin_user_pages_dirty_lock' as 1st parameter at
[drivers/xen/privcmd.c: 612].

---------------------------------------------------------------------
610     static void unlock_pages(struct page *pages[], unsigned int
nr_pages)
611     {
612             unpin_user_pages_dirty_lock(pages, nr_pages, true);
613     }
---------------------------------------------------------------------

'pages' and 'npages' are passed as parameters to function
'sanity_check_pinned_pages' at [mm/gup.c: 311].

---------------------------------------------------------------------
299     void unpin_user_pages_dirty_lock(struct page **pages, unsigned
long npages,
300                                      bool make_dirty)
301     {
302             unsigned long i;
303     struct folio *folio;
304     unsigned int nr;
305             
306             if (!make_dirty) {
307                     unpin_user_pages(pages, npages);
308                     return;
309             }
310
311             sanity_check_pinned_pages(pages, npages);
---------------------------------------------------------------------

In function 'sanity_check_pinned_pages', if
(IS_ENABLED(CONFIG_DEBUG_VM)) and (npages > 0), NULL pointer 'pages' is
dereferenced at [mm/gup.c: 51].

---------------------------------------------------------------------
32      static inline void sanity_check_pinned_pages(struct page
**pages,
33                                                   unsigned long
npages)
34      {
35              if (!IS_ENABLED(CONFIG_DEBUG_VM))
36                      return;
..
50              for (; npages; npages--, pages++) {
51                      struct page *page = *pages;
                                                                ^^^^^^
^
---------------------------------------------------------------------

Else if (!IS_ENABLED(CONFIG_DEBUG_VM)) and (npages > 0) function
'gup_folio_next' is called with 'pages' and 'npages' as parameters at
[mm/gup.c: 311].

---------------------------------------------------------------------
312             for (i = 0; i < npages; i += nr) {
313                     folio = gup_folio_next(pages, npages, i, &nr);
---------------------------------------------------------------------

In function 'gup_folio_next' NULL pointer 'list' is dereferenced at
[mm/gup.c: 263].

---------------------------------------------------------------------
262     static inline struct folio *gup_folio_next(struct page **list,
263                     unsigned long npages, unsigned long i,
unsigned int *ntails)
264     {
265             struct folio *folio = page_folio(list[i]);
                                                                
                ^^^^^^^^^
---------------------------------------------------------------------