From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: io_uring/kbuf.c:458 io_register_pbuf_ring() warn: comparison of a potentially tagged address (io_register_pbuf_ring, -2, reg.ring_addr)
Date: Sat, 9 Dec 2023 22:59:30 +0800 [thread overview]
Message-ID: <202312092223.ToTy1ant-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Jens Axboe <axboe@kernel.dk>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: f2e8a57ee9036c7d5443382b6c3c09b51a92ec7e
commit: 3b77495a97239faa27989f946d29b6be7dd091e9 io_uring: split provided buffers handling into its own file
date: 1 year, 5 months ago
:::::: branch date: 18 hours ago
:::::: commit date: 1 year, 5 months ago
config: arm64-randconfig-r081-20231127 (https://download.01.org/0day-ci/archive/20231209/202312092223.ToTy1ant-lkp@intel.com/config)
compiler: clang version 14.0.6 (https://github.com/llvm/llvm-project.git f28c006a5895fc0e329fe15fead81e37457cb1d1)
reproduce: (https://download.01.org/0day-ci/archive/20231209/202312092223.ToTy1ant-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202312092223.ToTy1ant-lkp@intel.com/
smatch warnings:
io_uring/kbuf.c:458 io_register_pbuf_ring() warn: comparison of a potentially tagged address (io_register_pbuf_ring, -2, reg.ring_addr)
vim +458 io_uring/kbuf.c
3b77495a97239f Jens Axboe 2022-06-13 442
3b77495a97239f Jens Axboe 2022-06-13 443 int io_register_pbuf_ring(struct io_ring_ctx *ctx, void __user *arg)
3b77495a97239f Jens Axboe 2022-06-13 444 {
3b77495a97239f Jens Axboe 2022-06-13 445 struct io_uring_buf_ring *br;
3b77495a97239f Jens Axboe 2022-06-13 446 struct io_uring_buf_reg reg;
3b77495a97239f Jens Axboe 2022-06-13 447 struct io_buffer_list *bl, *free_bl = NULL;
3b77495a97239f Jens Axboe 2022-06-13 448 struct page **pages;
3b77495a97239f Jens Axboe 2022-06-13 449 int nr_pages;
3b77495a97239f Jens Axboe 2022-06-13 450
3b77495a97239f Jens Axboe 2022-06-13 451 if (copy_from_user(®, arg, sizeof(reg)))
3b77495a97239f Jens Axboe 2022-06-13 452 return -EFAULT;
3b77495a97239f Jens Axboe 2022-06-13 453
3b77495a97239f Jens Axboe 2022-06-13 454 if (reg.pad || reg.resv[0] || reg.resv[1] || reg.resv[2])
3b77495a97239f Jens Axboe 2022-06-13 455 return -EINVAL;
3b77495a97239f Jens Axboe 2022-06-13 456 if (!reg.ring_addr)
3b77495a97239f Jens Axboe 2022-06-13 457 return -EFAULT;
3b77495a97239f Jens Axboe 2022-06-13 @458 if (reg.ring_addr & ~PAGE_MASK)
3b77495a97239f Jens Axboe 2022-06-13 459 return -EINVAL;
3b77495a97239f Jens Axboe 2022-06-13 460 if (!is_power_of_2(reg.ring_entries))
3b77495a97239f Jens Axboe 2022-06-13 461 return -EINVAL;
3b77495a97239f Jens Axboe 2022-06-13 462
3b77495a97239f Jens Axboe 2022-06-13 463 /* cannot disambiguate full vs empty due to head/tail size */
3b77495a97239f Jens Axboe 2022-06-13 464 if (reg.ring_entries >= 65536)
3b77495a97239f Jens Axboe 2022-06-13 465 return -EINVAL;
3b77495a97239f Jens Axboe 2022-06-13 466
3b77495a97239f Jens Axboe 2022-06-13 467 if (unlikely(reg.bgid < BGID_ARRAY && !ctx->io_bl)) {
3b77495a97239f Jens Axboe 2022-06-13 468 int ret = io_init_bl_list(ctx);
3b77495a97239f Jens Axboe 2022-06-13 469 if (ret)
3b77495a97239f Jens Axboe 2022-06-13 470 return ret;
3b77495a97239f Jens Axboe 2022-06-13 471 }
3b77495a97239f Jens Axboe 2022-06-13 472
3b77495a97239f Jens Axboe 2022-06-13 473 bl = io_buffer_get_list(ctx, reg.bgid);
3b77495a97239f Jens Axboe 2022-06-13 474 if (bl) {
3b77495a97239f Jens Axboe 2022-06-13 475 /* if mapped buffer ring OR classic exists, don't allow */
3b77495a97239f Jens Axboe 2022-06-13 476 if (bl->buf_nr_pages || !list_empty(&bl->buf_list))
3b77495a97239f Jens Axboe 2022-06-13 477 return -EEXIST;
3b77495a97239f Jens Axboe 2022-06-13 478 } else {
3b77495a97239f Jens Axboe 2022-06-13 479 free_bl = bl = kzalloc(sizeof(*bl), GFP_KERNEL);
3b77495a97239f Jens Axboe 2022-06-13 480 if (!bl)
3b77495a97239f Jens Axboe 2022-06-13 481 return -ENOMEM;
3b77495a97239f Jens Axboe 2022-06-13 482 }
3b77495a97239f Jens Axboe 2022-06-13 483
3b77495a97239f Jens Axboe 2022-06-13 484 pages = io_pin_pages(reg.ring_addr,
3b77495a97239f Jens Axboe 2022-06-13 485 struct_size(br, bufs, reg.ring_entries),
3b77495a97239f Jens Axboe 2022-06-13 486 &nr_pages);
3b77495a97239f Jens Axboe 2022-06-13 487 if (IS_ERR(pages)) {
3b77495a97239f Jens Axboe 2022-06-13 488 kfree(free_bl);
3b77495a97239f Jens Axboe 2022-06-13 489 return PTR_ERR(pages);
3b77495a97239f Jens Axboe 2022-06-13 490 }
3b77495a97239f Jens Axboe 2022-06-13 491
3b77495a97239f Jens Axboe 2022-06-13 492 br = page_address(pages[0]);
3b77495a97239f Jens Axboe 2022-06-13 493 bl->buf_pages = pages;
3b77495a97239f Jens Axboe 2022-06-13 494 bl->buf_nr_pages = nr_pages;
3b77495a97239f Jens Axboe 2022-06-13 495 bl->nr_entries = reg.ring_entries;
3b77495a97239f Jens Axboe 2022-06-13 496 bl->buf_ring = br;
3b77495a97239f Jens Axboe 2022-06-13 497 bl->mask = reg.ring_entries - 1;
3b77495a97239f Jens Axboe 2022-06-13 498 io_buffer_add_list(ctx, bl, reg.bgid);
3b77495a97239f Jens Axboe 2022-06-13 499 return 0;
3b77495a97239f Jens Axboe 2022-06-13 500 }
3b77495a97239f Jens Axboe 2022-06-13 501
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2023-12-09 14:59 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-09 14:59 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2023-04-30 22:14 io_uring/kbuf.c:458 io_register_pbuf_ring() warn: comparison of a potentially tagged address (io_register_pbuf_ring, -2, reg.ring_addr) kernel test robot
2022-11-05 8:17 kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202312092223.ToTy1ant-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.