Re: [PATCH v2 1/3] futex: Use explicit sizes for compat_exit_robust_list

kernel test robot
2024-11-02T14:57:44Z

Hi André,

kernel test robot noticed the following build warnings:

[auto build test WARNING on tip/locking/core]
[also build test WARNING on tip/sched/core linus/master tip/x86/asm v6.12-rc5 next-20241101]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url: https://github.com/intel-lab-lkp/linux/commits/Andr-Almeida/futex-Use-explicit-sizes-for-compat_exit_robust_list/20241102-002419
base: tip/locking/core
patch link: https://lore.kernel.org/r/20241101162147.284993-2-andrealmeid%40igalia.com
patch subject: [PATCH v2 1/3] futex: Use explicit sizes for compat_exit_robust_list
config: x86_64-randconfig-123-20241102 (https://download.01.org/0day-ci/archive/20241102/202411022242.XCJECOCz-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241102/202411022242.XCJECOCz-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411022242.XCJECOCz-lkp@intel.com/

sparse warnings: (new ones prefixed by >>)
>> kernel/futex/core.c:914:59: sparse: sparse: cast removes address space '__user' of expression
>> kernel/futex/core.c:914:59: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected unsigned int [noderef] [usertype] __user *head @@ got unsigned int [usertype] * @@
kernel/futex/core.c:914:59: sparse: expected unsigned int [noderef] [usertype] __user *head
kernel/futex/core.c:914:59: sparse: got unsigned int [usertype] *

vim +/__user +914 kernel/futex/core.c

893
894 /*
895 * Walk curr->robust_list (very carefully, it's a userspace list!)
896 * and mark any locks found there dead, and notify any waiters.
897 *
898 * We silently return on any sign of list-walking problem.
899 */
900 static void exit_robust_list32(struct task_struct *curr)
901 {
902 struct robust_list_head32 __user *head = curr->compat_robust_list;
903 struct robust_list __user *entry, *next_entry, *pending;
904 unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
905 unsigned int next_pi;
906 u32 uentry, next_uentry, upending;
907 s32 futex_offset;
908 int rc;
909
910 /*
911 * Fetch the list head (which was registered earlier, via
912 * sys_set_robust_list()):
913 */
> 914 if (fetch_robust_entry32((u32 *)&uentry, &entry, (u32 *)&head->list.next, &pi))
915 return;
916 /*
917 * Fetch the relative futex offset:
918 */
919 if (get_user(futex_offset, &head->futex_offset))
920 return;
921 /*
922 * Fetch any possibly pending lock-add first, and handle it
923 * if it exists:
924 */
925 if (fetch_robust_entry32(&upending, &pending,
926 &head->list_op_pending, &pip))
927 return;
928
929 next_entry = NULL; /* avoid warning with gcc */
930 while (entry != (struct robust_list __user *) &head->list) {
931 /*
932 * Fetch the next entry in the list before calling
933 * handle_futex_death:
934 */
935 rc = fetch_robust_entry32(&next_uentry, &next_entry,
936 (u32 __user *)&entry->next, &next_pi);
937 /*
938 * A pending lock might already be on the list, so
939 * dont process it twice:
940 */
941 if (entry != pending) {
942 void __user *uaddr = futex_uaddr(entry, futex_offset);
943
944 if (handle_futex_death(uaddr, curr, pi,
945 HANDLE_DEATH_LIST))
946 return;
947 }
948 if (rc)
949 return;
950 uentry = next_uentry;
951 entry = next_entry;
952 pi = next_pi;
953 /*
954 * Avoid excessively long or circular lists:
955 */
956 if (!--limit)
957 break;
958
959 cond_resched();
960 }
961 if (pending) {
962 void __user *uaddr = futex_uaddr(pending, futex_offset);
963
964 handle_futex_death(uaddr, curr, pip, HANDLE_DEATH_PENDING);
965 }
966 }
967

--
0-DAY CI Kernel Test Service