* [axboe:rw_iter 167/471] drivers/usb/misc/legousbtower.c:560 tower_read() warn: potential spectre issue 'dev->read_buffer' [r]
@ 2026-03-07 5:09 kernel test robot
0 siblings, 0 replies; only message in thread
From: kernel test robot @ 2026-03-07 5:09 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Jens Axboe <axboe@kernel.dk>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git rw_iter
head: 0a49759be1c3b29207758e467fdc1a90d0716d06
commit: ab14a2d8805f51e6237da6110c3351e3ebf43a96 [167/471] usb: misc: convert to read/write iterators
:::::: branch date: 18 hours ago
:::::: commit date: 18 hours ago
config: m68k-randconfig-r073-20260307 (https://download.01.org/0day-ci/archive/20260307/202603071341.ETiVsPCD-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 12.5.0
smatch: v0.5.0-9004-gb810ac53
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202603071341.ETiVsPCD-lkp@intel.com/
smatch warnings:
drivers/usb/misc/legousbtower.c:560 tower_read() warn: potential spectre issue 'dev->read_buffer' [r]
vim +560 drivers/usb/misc/legousbtower.c
^1da177e4c3f41 Linus Torvalds 2005-04-16 487
^1da177e4c3f41 Linus Torvalds 2005-04-16 488
464b7d0e538ef2 Lee Jones 2020-07-06 489 /*
^1da177e4c3f41 Linus Torvalds 2005-04-16 490 * tower_read
^1da177e4c3f41 Linus Torvalds 2005-04-16 491 */
ab14a2d8805f51 Jens Axboe 2024-04-11 492 static ssize_t tower_read(struct kiocb *iocb, struct iov_iter *to)
^1da177e4c3f41 Linus Torvalds 2005-04-16 493 {
ab14a2d8805f51 Jens Axboe 2024-04-11 494 size_t count = iov_iter_count(to);
^1da177e4c3f41 Linus Torvalds 2005-04-16 495 struct lego_usb_tower *dev;
^1da177e4c3f41 Linus Torvalds 2005-04-16 496 size_t bytes_to_read;
^1da177e4c3f41 Linus Torvalds 2005-04-16 497 int i;
^1da177e4c3f41 Linus Torvalds 2005-04-16 498 int retval = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 499 unsigned long timeout = 0;
^1da177e4c3f41 Linus Torvalds 2005-04-16 500
ab14a2d8805f51 Jens Axboe 2024-04-11 501 dev = iocb->ki_filp->private_data;
^1da177e4c3f41 Linus Torvalds 2005-04-16 502
^1da177e4c3f41 Linus Torvalds 2005-04-16 503 /* lock this object */
18bcbcfe9ca230 Daniel Walker 2008-01-11 504 if (mutex_lock_interruptible(&dev->lock)) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 505 retval = -ERESTARTSYS;
^1da177e4c3f41 Linus Torvalds 2005-04-16 506 goto exit;
^1da177e4c3f41 Linus Torvalds 2005-04-16 507 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 508
^1da177e4c3f41 Linus Torvalds 2005-04-16 509 /* verify that the device wasn't unplugged */
cd81e6fa8e033e Johan Hovold 2019-09-19 510 if (dev->disconnected) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 511 retval = -ENODEV;
^1da177e4c3f41 Linus Torvalds 2005-04-16 512 goto unlock_exit;
^1da177e4c3f41 Linus Torvalds 2005-04-16 513 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 514
^1da177e4c3f41 Linus Torvalds 2005-04-16 515 /* verify that we actually have some data to read */
^1da177e4c3f41 Linus Torvalds 2005-04-16 516 if (count == 0) {
fef526cae70047 Greg Kroah-Hartman 2013-06-26 517 dev_dbg(&dev->udev->dev, "read request of 0 bytes\n");
^1da177e4c3f41 Linus Torvalds 2005-04-16 518 goto unlock_exit;
^1da177e4c3f41 Linus Torvalds 2005-04-16 519 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 520
3c84f4bbe33f1f Johan Hovold 2019-11-05 521 if (read_timeout)
8f7e9473ab6213 Nicholas Mc Guire 2015-02-06 522 timeout = jiffies + msecs_to_jiffies(read_timeout);
^1da177e4c3f41 Linus Torvalds 2005-04-16 523
^1da177e4c3f41 Linus Torvalds 2005-04-16 524 /* wait for data */
^1da177e4c3f41 Linus Torvalds 2005-04-16 525 tower_check_for_read_packet(dev);
^1da177e4c3f41 Linus Torvalds 2005-04-16 526 while (dev->read_packet_length == 0) {
ab14a2d8805f51 Jens Axboe 2024-04-11 527 if (iocb->ki_filp->f_flags & O_NONBLOCK) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 528 retval = -EAGAIN;
^1da177e4c3f41 Linus Torvalds 2005-04-16 529 goto unlock_exit;
^1da177e4c3f41 Linus Torvalds 2005-04-16 530 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 531 retval = wait_event_interruptible_timeout(dev->read_wait, dev->interrupt_in_done, dev->packet_timeout_jiffies);
3c84f4bbe33f1f Johan Hovold 2019-11-05 532 if (retval < 0)
^1da177e4c3f41 Linus Torvalds 2005-04-16 533 goto unlock_exit;
^1da177e4c3f41 Linus Torvalds 2005-04-16 534
^1da177e4c3f41 Linus Torvalds 2005-04-16 535 /* reset read timeout during read or write activity */
^1da177e4c3f41 Linus Torvalds 2005-04-16 536 if (read_timeout
^1da177e4c3f41 Linus Torvalds 2005-04-16 537 && (dev->read_buffer_length || dev->interrupt_out_busy)) {
8f7e9473ab6213 Nicholas Mc Guire 2015-02-06 538 timeout = jiffies + msecs_to_jiffies(read_timeout);
^1da177e4c3f41 Linus Torvalds 2005-04-16 539 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 540 /* check for read timeout */
^1da177e4c3f41 Linus Torvalds 2005-04-16 541 if (read_timeout && time_after(jiffies, timeout)) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 542 retval = -ETIMEDOUT;
^1da177e4c3f41 Linus Torvalds 2005-04-16 543 goto unlock_exit;
^1da177e4c3f41 Linus Torvalds 2005-04-16 544 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 545 tower_check_for_read_packet(dev);
^1da177e4c3f41 Linus Torvalds 2005-04-16 546 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 547
^1da177e4c3f41 Linus Torvalds 2005-04-16 548 /* copy the data from read_buffer into userspace */
^1da177e4c3f41 Linus Torvalds 2005-04-16 549 bytes_to_read = min(count, dev->read_packet_length);
^1da177e4c3f41 Linus Torvalds 2005-04-16 550
ab14a2d8805f51 Jens Axboe 2024-04-11 551 if (!copy_to_iter_full(dev->read_buffer, bytes_to_read, to)) {
^1da177e4c3f41 Linus Torvalds 2005-04-16 552 retval = -EFAULT;
^1da177e4c3f41 Linus Torvalds 2005-04-16 553 goto unlock_exit;
^1da177e4c3f41 Linus Torvalds 2005-04-16 554 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 555
^1da177e4c3f41 Linus Torvalds 2005-04-16 556 spin_lock_irq(&dev->read_buffer_lock);
^1da177e4c3f41 Linus Torvalds 2005-04-16 557 dev->read_buffer_length -= bytes_to_read;
^1da177e4c3f41 Linus Torvalds 2005-04-16 558 dev->read_packet_length -= bytes_to_read;
3c84f4bbe33f1f Johan Hovold 2019-11-05 559 for (i = 0; i < dev->read_buffer_length; i++)
^1da177e4c3f41 Linus Torvalds 2005-04-16 @560 dev->read_buffer[i] = dev->read_buffer[i+bytes_to_read];
^1da177e4c3f41 Linus Torvalds 2005-04-16 561 spin_unlock_irq(&dev->read_buffer_lock);
^1da177e4c3f41 Linus Torvalds 2005-04-16 562
^1da177e4c3f41 Linus Torvalds 2005-04-16 563 retval = bytes_to_read;
^1da177e4c3f41 Linus Torvalds 2005-04-16 564
^1da177e4c3f41 Linus Torvalds 2005-04-16 565 unlock_exit:
^1da177e4c3f41 Linus Torvalds 2005-04-16 566 /* unlock the device */
18bcbcfe9ca230 Daniel Walker 2008-01-11 567 mutex_unlock(&dev->lock);
^1da177e4c3f41 Linus Torvalds 2005-04-16 568
^1da177e4c3f41 Linus Torvalds 2005-04-16 569 exit:
^1da177e4c3f41 Linus Torvalds 2005-04-16 570 return retval;
^1da177e4c3f41 Linus Torvalds 2005-04-16 571 }
^1da177e4c3f41 Linus Torvalds 2005-04-16 572
:::::: The code at line 560 was first introduced by commit
:::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2
:::::: TO: Linus Torvalds <torvalds@ppc970.osdl.org>
:::::: CC: Linus Torvalds <torvalds@ppc970.osdl.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-03-07 5:10 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-03-07 5:09 [axboe:rw_iter 167/471] drivers/usb/misc/legousbtower.c:560 tower_read() warn: potential spectre issue 'dev->read_buffer' [r] kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.