[tip:x86/shstk 10/24] arch/x86/kernel/shstk.c:244:29: sparse: sparse: incorrect type in argument 1 (different address spaces)

[tip:x86/shstk 10/24] arch/x86/kernel/shstk.c:244:29: sparse: sparse: incorrect type in argument 1 (different address spaces)

[kernel test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git x86/shstk
head:   c6cfcbd8ca43766851a8c952e3b570727147020f
commit: 05e36022c0543ba55a3de55af455b00cb3eb4fcc [10/24] x86/shstk: Handle signals for shadow stack
config: x86_64-randconfig-r133-20230822 (https://download.01.org/0day-ci/archive/20230822/202308222312.Jt4Tog5T-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce: (https://download.01.org/0day-ci/archive/20230822/202308222312.Jt4Tog5T-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202308222312.Jt4Tog5T-lkp@intel.com/

sparse warnings: (new ones prefixed by >>)
>> arch/x86/kernel/shstk.c:244:29: sparse: sparse: incorrect type in argument 1 (different address spaces) @@     expected unsigned long long [noderef] [usertype] __user *addr @@     got void *[noderef] __user @@
   arch/x86/kernel/shstk.c:244:29: sparse:     expected unsigned long long [noderef] [usertype] __user *addr
   arch/x86/kernel/shstk.c:244:29: sparse:     got void *[noderef] __user
>> arch/x86/kernel/shstk.c:295:55: sparse: sparse: cast removes address space '__user' of expression

vim +244 arch/x86/kernel/shstk.c

   234	
   235	static int shstk_push_sigframe(unsigned long *ssp)
   236	{
   237		unsigned long target_ssp = *ssp;
   238	
   239		/* Token must be aligned */
   240		if (!IS_ALIGNED(target_ssp, 8))
   241			return -EINVAL;
   242	
   243		*ssp -= SS_FRAME_SIZE;
 > 244		if (put_shstk_data((void *__user)*ssp, target_ssp))
   245			return -EFAULT;
   246	
   247		return 0;
   248	}
   249	
   250	static int shstk_pop_sigframe(unsigned long *ssp)
   251	{
   252		unsigned long token_addr;
   253		int err;
   254	
   255		err = get_shstk_data(&token_addr, (unsigned long __user *)*ssp);
   256		if (unlikely(err))
   257			return err;
   258	
   259		/* Restore SSP aligned? */
   260		if (unlikely(!IS_ALIGNED(token_addr, 8)))
   261			return -EINVAL;
   262	
   263		/* SSP in userspace? */
   264		if (unlikely(token_addr >= TASK_SIZE_MAX))
   265			return -EINVAL;
   266	
   267		*ssp = token_addr;
   268	
   269		return 0;
   270	}
   271	
   272	int setup_signal_shadow_stack(struct ksignal *ksig)
   273	{
   274		void __user *restorer = ksig->ka.sa.sa_restorer;
   275		unsigned long ssp;
   276		int err;
   277	
   278		if (!cpu_feature_enabled(X86_FEATURE_USER_SHSTK) ||
   279		    !features_enabled(ARCH_SHSTK_SHSTK))
   280			return 0;
   281	
   282		if (!restorer)
   283			return -EINVAL;
   284	
   285		ssp = get_user_shstk_addr();
   286		if (unlikely(!ssp))
   287			return -EINVAL;
   288	
   289		err = shstk_push_sigframe(&ssp);
   290		if (unlikely(err))
   291			return err;
   292	
   293		/* Push restorer address */
   294		ssp -= SS_FRAME_SIZE;
 > 295		err = write_user_shstk_64((u64 __user *)ssp, (u64)restorer);
   296		if (unlikely(err))
   297			return -EFAULT;
   298	
   299		fpregs_lock_and_load();
   300		wrmsrl(MSR_IA32_PL3_SSP, ssp);
   301		fpregs_unlock();
   302	
   303		return 0;
   304	}
   305	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

[PATCH] x86/shstk: Change order of __user in type

[Rick Edgecombe]

0day reports a sparse warning:
arch/x86/kernel/shstk.c:295:55: sparse: sparse: cast removes address space
'__user' of expression

The __user is in the wrong spot. Move it to right spot and make sparse
happy.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202308222312.Jt4Tog5T-lkp@intel.com/
Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>
---
 arch/x86/kernel/shstk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c
index cd10d074a444..fd689921a1db 100644
--- a/arch/x86/kernel/shstk.c
+++ b/arch/x86/kernel/shstk.c
@@ -275,7 +275,7 @@ static int shstk_push_sigframe(unsigned long *ssp)
 		return -EINVAL;
 
 	*ssp -= SS_FRAME_SIZE;
-	if (put_shstk_data((void *__user)*ssp, target_ssp))
+	if (put_shstk_data((void __user *)*ssp, target_ssp))
 		return -EFAULT;
 
 	return 0;
-- 
2.34.1

Re: [PATCH] x86/shstk: Change order of __user in type

[Kees Cook]

On Thu, Aug 24, 2023 at 06:45:54PM -0700, Rick Edgecombe wrote:
> 0day reports a sparse warning:
> arch/x86/kernel/shstk.c:295:55: sparse: sparse: cast removes address space
> '__user' of expression
> 
> The __user is in the wrong spot. Move it to right spot and make sparse
> happy.
> 
> Reported-by: kernel test robot <lkp@intel.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202308222312.Jt4Tog5T-lkp@intel.com/
> Signed-off-by: Rick Edgecombe <rick.p.edgecombe@intel.com>

Ah yeah, a good find. I with we could sanely use "address spaces" in GCC
and Clang so we didn't need to depend on sparse for these checks. I
tried to get Clang doing it[1] a few years ago, but the wall of warnings
was huge.

Reviewed-by: Kees Cook <keescook@chromium.org>

-Kees

[1] https://git.kernel.org/pub/scm/linux/kernel/git/kees/linux.git/commit/?h=clang/address_space&id=beff911c13390a71b3f7921fd82ec6a71ca75c02

-- 
Kees Cook