[axboe:rw_iter 39/471] fs/libfs.c:1514 __simple_write_iter() warn: potential spectre issue 'attr->set_buf' [w]

[kernel test robot <lkp@intel.com>]

BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Jens Axboe <axboe@kernel.dk>

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git rw_iter
head:   0a49759be1c3b29207758e467fdc1a90d0716d06
commit: 7b40f9995773bf20c745784d976fc4e3cfc54699 [39/471] libfs: switch to read iter and add copy helpers
:::::: branch date: 4 days ago
:::::: commit date: 6 days ago
config: openrisc-randconfig-r071-20260307 (https://download.01.org/0day-ci/archive/20260310/202603102208.xRXDgO2R-lkp@intel.com/config)
compiler: or1k-linux-gcc (GCC) 15.2.0
smatch: v0.5.0-9004-gb810ac53

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202603102208.xRXDgO2R-lkp@intel.com/

smatch warnings:
fs/libfs.c:1514 __simple_write_iter() warn: potential spectre issue 'attr->set_buf' [w]

vim +1514 fs/libfs.c

7b40f9995773bf Jens Axboe 2024-04-03  1491  
7b40f9995773bf Jens Axboe 2024-04-03  1492  static ssize_t __simple_write_iter(struct kiocb *iocb, struct iov_iter *from,
7b40f9995773bf Jens Axboe 2024-04-03  1493  				   bool is_signed)
7b40f9995773bf Jens Axboe 2024-04-03  1494  {
7b40f9995773bf Jens Axboe 2024-04-03  1495  	struct simple_attr *attr;
7b40f9995773bf Jens Axboe 2024-04-03  1496  	unsigned long long val;
7b40f9995773bf Jens Axboe 2024-04-03  1497  	size_t len = iov_iter_count(from);
7b40f9995773bf Jens Axboe 2024-04-03  1498  	size_t size;
7b40f9995773bf Jens Axboe 2024-04-03  1499  	ssize_t ret;
7b40f9995773bf Jens Axboe 2024-04-03  1500  
7b40f9995773bf Jens Axboe 2024-04-03  1501  	attr = iocb->ki_filp->private_data;
7b40f9995773bf Jens Axboe 2024-04-03  1502  	if (!attr->set)
7b40f9995773bf Jens Axboe 2024-04-03  1503  		return -EACCES;
7b40f9995773bf Jens Axboe 2024-04-03  1504  
7b40f9995773bf Jens Axboe 2024-04-03  1505  	ret = mutex_lock_interruptible(&attr->mutex);
7b40f9995773bf Jens Axboe 2024-04-03  1506  	if (ret)
7b40f9995773bf Jens Axboe 2024-04-03  1507  		return ret;
7b40f9995773bf Jens Axboe 2024-04-03  1508  
7b40f9995773bf Jens Axboe 2024-04-03  1509  	ret = -EFAULT;
7b40f9995773bf Jens Axboe 2024-04-03  1510  	size = min(sizeof(attr->set_buf) - 1, len);
7b40f9995773bf Jens Axboe 2024-04-03  1511  	if (!copy_from_iter(attr->set_buf, size, from))
7b40f9995773bf Jens Axboe 2024-04-03  1512  		goto out;
7b40f9995773bf Jens Axboe 2024-04-03  1513  
7b40f9995773bf Jens Axboe 2024-04-03 @1514  	attr->set_buf[size] = '\0';
7b40f9995773bf Jens Axboe 2024-04-03  1515  	if (is_signed)
7b40f9995773bf Jens Axboe 2024-04-03  1516  		ret = kstrtoll(attr->set_buf, 0, &val);
7b40f9995773bf Jens Axboe 2024-04-03  1517  	else
7b40f9995773bf Jens Axboe 2024-04-03  1518  		ret = kstrtoull(attr->set_buf, 0, &val);
7b40f9995773bf Jens Axboe 2024-04-03  1519  	if (ret)
7b40f9995773bf Jens Axboe 2024-04-03  1520  		goto out;
7b40f9995773bf Jens Axboe 2024-04-03  1521  	ret = attr->set(attr->data, val);
7b40f9995773bf Jens Axboe 2024-04-03  1522  	if (ret == 0)
7b40f9995773bf Jens Axboe 2024-04-03  1523  		ret = len; /* on success, claim we got the whole input */
7b40f9995773bf Jens Axboe 2024-04-03  1524  out:
7b40f9995773bf Jens Axboe 2024-04-03  1525  	mutex_unlock(&attr->mutex);
7b40f9995773bf Jens Axboe 2024-04-03  1526  	return ret;
7b40f9995773bf Jens Axboe 2024-04-03  1527  }
7b40f9995773bf Jens Axboe 2024-04-03  1528  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki