From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [axboe:rw_iter 71/471] kernel/dma/debug.c:775 filter_write() warn: potential spectre issue 'buf' [w]
Date: Sun, 08 Mar 2026 13:15:36 +0800 [thread overview]
Message-ID: <202603081355.2PyKPc2I-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Jens Axboe <axboe@kernel.dk>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git rw_iter
head: 0a49759be1c3b29207758e467fdc1a90d0716d06
commit: db55ad0fd65c64db85d76db88cc2549d6aa1f98c [71/471] dma-debug: convert to read/write iterators
:::::: branch date: 2 days ago
:::::: commit date: 2 days ago
config: openrisc-randconfig-r071-20260307 (https://download.01.org/0day-ci/archive/20260308/202603081355.2PyKPc2I-lkp@intel.com/config)
compiler: or1k-linux-gcc (GCC) 15.2.0
smatch: v0.5.0-9004-gb810ac53
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202603081355.2PyKPc2I-lkp@intel.com/
smatch warnings:
kernel/dma/debug.c:775 filter_write() warn: potential spectre issue 'buf' [w]
vim +/buf +775 kernel/dma/debug.c
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 756
db55ad0fd65c64 kernel/dma/debug.c Jens Axboe 2024-04-08 757 static ssize_t filter_write(struct kiocb *iocb, struct iov_iter *from)
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 758 {
db55ad0fd65c64 kernel/dma/debug.c Jens Axboe 2024-04-08 759 size_t count = iov_iter_count(from);
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 760 char buf[NAME_MAX_LEN];
c17e2cf7376a20 lib/dma-debug.c Joerg Roedel 2009-06-08 761 unsigned long flags;
c17e2cf7376a20 lib/dma-debug.c Joerg Roedel 2009-06-08 762 size_t len;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 763 int i;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 764
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 765 /*
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 766 * We can't copy from userspace directly. Access to
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 767 * current_driver_name is protected with a write_lock with irqs
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 768 * disabled. Since copy_from_user can fault and may sleep we
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 769 * need to copy to temporary buffer first
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 770 */
e7ed70eedccc78 lib/dma-debug.c Joerg Roedel 2009-06-08 771 len = min(count, (size_t)(NAME_MAX_LEN - 1));
db55ad0fd65c64 kernel/dma/debug.c Jens Axboe 2024-04-08 772 if (!copy_from_iter_full(buf, len, from))
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 773 return -EFAULT;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 774
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 @775 buf[len] = 0;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 776
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 777 write_lock_irqsave(&driver_name_lock, flags);
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 778
31232509478556 lib/dma-debug.c Joerg Roedel 2009-06-08 779 /*
31232509478556 lib/dma-debug.c Joerg Roedel 2009-06-08 780 * Now handle the string we got from userspace very carefully.
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 781 * The rules are:
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 782 * - only use the first token we got
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 783 * - token delimiter is everything looking like a space
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 784 * character (' ', '\n', '\t' ...)
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 785 *
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 786 */
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 787 if (!isalnum(buf[0])) {
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 788 /*
31232509478556 lib/dma-debug.c Joerg Roedel 2009-06-08 789 * If the first character userspace gave us is not
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 790 * alphanumerical then assume the filter should be
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 791 * switched off.
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 792 */
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 793 if (current_driver_name[0])
f737b095c60c63 kernel/dma/debug.c Robin Murphy 2018-12-10 794 pr_info("switching off dma-debug driver filter\n");
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 795 current_driver_name[0] = 0;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 796 current_driver = NULL;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 797 goto out_unlock;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 798 }
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 799
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 800 /*
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 801 * Now parse out the first token and use it as the name for the
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 802 * driver to filter for.
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 803 */
39a37ce1cc5eef lib/dma-debug.c Dan Carpenter 2010-04-06 804 for (i = 0; i < NAME_MAX_LEN - 1; ++i) {
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 805 current_driver_name[i] = buf[i];
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 806 if (isspace(buf[i]) || buf[i] == ' ' || buf[i] == 0)
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 807 break;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 808 }
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 809 current_driver_name[i] = 0;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 810 current_driver = NULL;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 811
f737b095c60c63 kernel/dma/debug.c Robin Murphy 2018-12-10 812 pr_info("enable driver filter for driver [%s]\n",
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 813 current_driver_name);
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 814
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 815 out_unlock:
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 816 write_unlock_irqrestore(&driver_name_lock, flags);
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 817
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 818 return count;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 819 }
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 820
:::::: The code at line 775 was first introduced by commit
:::::: 8a6fc708b9bb48a79a385bdc2be0959ee2ab788d dma-debug: add debugfs file for driver filter
:::::: TO: Joerg Roedel <joerg.roedel@amd.com>
:::::: CC: Joerg Roedel <joerg.roedel@amd.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-03-08 5:15 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-08 5:15 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2026-03-11 0:27 [axboe:rw_iter 71/471] kernel/dma/debug.c:775 filter_write() warn: potential spectre issue 'buf' [w] kernel test robot
2026-03-09 13:57 kernel test robot
2026-03-07 12:43 kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202603081355.2PyKPc2I-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.