Re: [PATCH net] net/mlx4: avoid GCC 10 __bad_copy_from() false positive

[Paolo Abeni <pabeni@redhat.com>]

On 5/25/26 12:47 PM, Tariq Toukan wrote:
> On 20/05/2026 13:21, Yao Sang wrote:
>> mlx4_init_user_cqes() allocates a single PAGE_SIZE buffer and fills it
>> with the CQE initialization pattern. When entries_per_copy >= entries,
>> the function copies array_size(entries, cqe_size) bytes from that buffer
>> to userspace.
>>
>> That copy is actually bounded by PAGE_SIZE in the else branch because
>> entries_per_copy >= entries implies entries * cqe_size <= PAGE_SIZE.
>> However, GCC 10 does not derive that constraint and falsely triggers
>> __bad_copy_from() in mlx4_init_user_cqes().
>>
>> Cap the single copy_to_user() length to PAGE_SIZE to make that bound
>> explicit and avoid the GCC 10 false positive.
>>
>> Fixes: f69bf5dee7ef ("net/mlx4: Use array_size() helper in copy_to_user()")
>> Signed-off-by: Yao Sang <sangyao@kylinos.cn>
>> ---
>>   drivers/net/ethernet/mellanox/mlx4/cq.c | 5 ++++-
>>   1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c
>> index e130e7259275..7b024a5e13c8 100644
>> --- a/drivers/net/ethernet/mellanox/mlx4/cq.c
>> +++ b/drivers/net/ethernet/mellanox/mlx4/cq.c
>> @@ -314,8 +314,11 @@ static int mlx4_init_user_cqes(void *buf, int entries, int cqe_size)
>>   			buf += PAGE_SIZE;
>>   		}
>>   	} else {
>> +		size_t copy_bytes = min_t(size_t, array_size(entries, cqe_size),
>> +					 PAGE_SIZE);
>> +
>>   		err = copy_to_user((void __user *)buf, init_ents,
>> -				   array_size(entries, cqe_size)) ?
>> +				   copy_bytes) ?
>>   			-EFAULT : 0;
>>   	}
>>   
> 
> Thanks for your patch.
> 
> This is a compiler issue.
> Did you try fixing it there first?

AFAICS gcc 10 is a supported version, the kernel should build correctly
with it, right?

Also AFAICS this is not fastpath so an additional check should not be
problematic? Perhaps a warn instead would be more palatable?

		if (WARN_ON_ONCE(array_size(entries, cqe_size) > PAGE_SIZE))
			// ...

/P