mm: (un)track_pfn_copy() fix + doc improvements

commit 8c56c5d
Author: David Hildenbrand <david@redhat.com>
Date:   Tue Apr 8 10:59:50 2025 +0200

    mm: (un)track_pfn_copy() fix + doc improvements

    We got a late smatch warning and some additional review feedback.

            smatch warnings:
            mm/memory.c:1428 copy_page_range() error: uninitialized symbol 'pfn'.

    We actually use the pfn only when it is properly initialized; however, we
    may pass an uninitialized value to a function -- although it will not use
    it that likely still is UB in C.

    So let's just fix it by always initializing pfn in the caller of
    track_pfn_copy(), and improving the documentation of track_pfn_copy().

    While at it, clarify the doc of untrack_pfn_copy(), that internal checks
    make sure if we actually have to untrack anything.

    Link: https://lkml.kernel.org/r/20250408085950.976103-1-david@redhat.com
    Fixes: dc84bc2 ("x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range()")
    Signed-off-by: David Hildenbrand <david@redhat.com>
    Reported-by: kernel test robot <lkp@intel.com>
    Reported-by: Dan Carpenter <error27@gmail.com>
    Closes: https://lore.kernel.org/r/202503270941.IFILyNCX-lkp@intel.com/
    Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
    Acked-by: Ingo Molnar <mingo@kernel.org>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Dave Hansen <dave.hansen@linux.intel.com>
    Cc: Andy Lutomirski <luto@kernel.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Borislav Petkov <bp@alien8.de>
    Cc: Rik van Riel <riel@surriel.com>
    Cc: "H. Peter Anvin" <hpa@zytor.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

JIRA: https://issues.redhat.com/browse/RHEL-77742
Signed-off-by: Nico Pache <npache@redhat.com>

Author: PacheNico

include/linux/pgtable.h

@@ -1540,8 +1540,9 @@ static inline void track_pfn_insert(struct vm_area_struct *vma, pgprot_t *prot,
 
 /*
  * track_pfn_copy is called when a VM_PFNMAP VMA is about to get the page
- * tables copied during copy_page_range(). On success, stores the pfn to be
- * passed to untrack_pfn_copy().
+ * tables copied during copy_page_range(). Will store the pfn to be
+ * passed to untrack_pfn_copy() only if there is something to be untracked.
+ * Callers should initialize the pfn to 0.
  */
 static inline int track_pfn_copy(struct vm_area_struct *dst_vma,
 		struct vm_area_struct *src_vma, unsigned long *pfn)
@@ -1551,7 +1552,9 @@ static inline int track_pfn_copy(struct vm_area_struct *dst_vma,
 
 /*
  * untrack_pfn_copy is called when a VM_PFNMAP VMA failed to copy during
- * copy_page_range(), but after track_pfn_copy() was already called.
+ * copy_page_range(), but after track_pfn_copy() was already called. Can
+ * be called even if track_pfn_copy() did not actually track anything:
+ * handled internally.
  */
 static inline void untrack_pfn_copy(struct vm_area_struct *dst_vma,
 		unsigned long pfn)

mm/memory.c

@@ -1367,7 +1367,7 @@ copy_page_range(struct vm_area_struct *dst_vma, struct vm_area_struct *src_vma)
 	struct mm_struct *dst_mm = dst_vma->vm_mm;
 	struct mm_struct *src_mm = src_vma->vm_mm;
 	struct mmu_notifier_range range;
-	unsigned long next, pfn;
+	unsigned long next, pfn = 0;
 	bool is_cow;
 	int ret;