* mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
@ 2024-09-22 11:36 kernel test robot
0 siblings, 0 replies; 9+ messages in thread
From: kernel test robot @ 2024-09-22 11:36 UTC (permalink / raw)
To: Ilya Leoshkevich
Cc: oe-kbuild-all, linux-kernel, Andrew Morton,
Linux Memory Management List, Alexander Potapenko
Hi Ilya,
First bad commit (maybe != root cause):
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 88264981f2082248e892a706b2c5004650faac54
commit: 3a8f6f3b469b4075919a3613e182f9a70df92d46 kmsan: enable on s390
date: 3 months ago
config: s390-randconfig-r121-20240922 (https://download.01.org/0day-ci/archive/20240922/202409221923.Z2I9fBpk-lkp@intel.com/config)
compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 8663a75fa2f31299ab8d1d90288d9df92aadee88)
reproduce: (https://download.01.org/0day-ci/archive/20240922/202409221923.Z2I9fBpk-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202409221923.Z2I9fBpk-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:271:75: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void const *user_addr @@ got void [noderef] __user *to @@
mm/kmsan/hooks.c:271:75: sparse: expected void const *user_addr
mm/kmsan/hooks.c:271:75: sparse: got void [noderef] __user *to
mm/kmsan/hooks.c:280:50: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:306:59: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:319:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:325:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:421:78: sparse: sparse: Using plain integer as NULL pointer
vim +/__user +269 mm/kmsan/hooks.c
b073d7f8aee4eb Alexander Potapenko 2022-09-15 247
75cf0290271bf6 Alexander Potapenko 2022-09-15 248 void kmsan_copy_to_user(void __user *to, const void *from, size_t to_copy,
75cf0290271bf6 Alexander Potapenko 2022-09-15 249 size_t left)
75cf0290271bf6 Alexander Potapenko 2022-09-15 250 {
75cf0290271bf6 Alexander Potapenko 2022-09-15 251 unsigned long ua_flags;
75cf0290271bf6 Alexander Potapenko 2022-09-15 252
75cf0290271bf6 Alexander Potapenko 2022-09-15 253 if (!kmsan_enabled || kmsan_in_runtime())
75cf0290271bf6 Alexander Potapenko 2022-09-15 254 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 255 /*
75cf0290271bf6 Alexander Potapenko 2022-09-15 256 * At this point we've copied the memory already. It's hard to check it
75cf0290271bf6 Alexander Potapenko 2022-09-15 257 * before copying, as the size of actually copied buffer is unknown.
75cf0290271bf6 Alexander Potapenko 2022-09-15 258 */
75cf0290271bf6 Alexander Potapenko 2022-09-15 259
75cf0290271bf6 Alexander Potapenko 2022-09-15 260 /* copy_to_user() may copy zero bytes. No need to check. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 261 if (!to_copy)
75cf0290271bf6 Alexander Potapenko 2022-09-15 262 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 263 /* Or maybe copy_to_user() failed to copy anything. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 264 if (to_copy <= left)
75cf0290271bf6 Alexander Potapenko 2022-09-15 265 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 266
75cf0290271bf6 Alexander Potapenko 2022-09-15 267 ua_flags = user_access_save();
f926e9326f3a79 Ilya Leoshkevich 2024-06-21 268 if (!IS_ENABLED(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) ||
f926e9326f3a79 Ilya Leoshkevich 2024-06-21 @269 (u64)to < TASK_SIZE) {
75cf0290271bf6 Alexander Potapenko 2022-09-15 270 /* This is a user memory access, check it. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 271 kmsan_internal_check_memory((void *)from, to_copy - left, to,
75cf0290271bf6 Alexander Potapenko 2022-09-15 272 REASON_COPY_TO_USER);
75cf0290271bf6 Alexander Potapenko 2022-09-15 273 } else {
75cf0290271bf6 Alexander Potapenko 2022-09-15 274 /* Otherwise this is a kernel memory access. This happens when a
75cf0290271bf6 Alexander Potapenko 2022-09-15 275 * compat syscall passes an argument allocated on the kernel
75cf0290271bf6 Alexander Potapenko 2022-09-15 276 * stack to a real syscall.
75cf0290271bf6 Alexander Potapenko 2022-09-15 277 * Don't check anything, just copy the shadow of the copied
75cf0290271bf6 Alexander Potapenko 2022-09-15 278 * bytes.
75cf0290271bf6 Alexander Potapenko 2022-09-15 279 */
75cf0290271bf6 Alexander Potapenko 2022-09-15 280 kmsan_internal_memmove_metadata((void *)to, (void *)from,
75cf0290271bf6 Alexander Potapenko 2022-09-15 281 to_copy - left);
75cf0290271bf6 Alexander Potapenko 2022-09-15 282 }
75cf0290271bf6 Alexander Potapenko 2022-09-15 283 user_access_restore(ua_flags);
75cf0290271bf6 Alexander Potapenko 2022-09-15 284 }
75cf0290271bf6 Alexander Potapenko 2022-09-15 285 EXPORT_SYMBOL(kmsan_copy_to_user);
75cf0290271bf6 Alexander Potapenko 2022-09-15 286
:::::: The code at line 269 was first introduced by commit
:::::: f926e9326f3a79f7e01ac790e2361f44d8ca8320 kmsan: fix kmsan_copy_to_user() on arches with overlapping address spaces
:::::: TO: Ilya Leoshkevich <iii@linux.ibm.com>
:::::: CC: Andrew Morton <akpm@linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 9+ messages in thread
* mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
@ 2024-11-01 4:56 kernel test robot
0 siblings, 0 replies; 9+ messages in thread
From: kernel test robot @ 2024-11-01 4:56 UTC (permalink / raw)
To: Ilya Leoshkevich
Cc: oe-kbuild-all, linux-kernel, Andrew Morton,
Linux Memory Management List, Alexander Potapenko
Hi Ilya,
First bad commit (maybe != root cause):
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 6c52d4da1c742cd01a797a4d0a2d3c5a60dc9bfe
commit: 3a8f6f3b469b4075919a3613e182f9a70df92d46 kmsan: enable on s390
date: 4 months ago
config: s390-randconfig-r112-20241030 (https://download.01.org/0day-ci/archive/20241101/202411011212.6RM81BEd-lkp@intel.com/config)
compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 639a7ac648f1e50ccd2556e17d401c04f9cce625)
reproduce: (https://download.01.org/0day-ci/archive/20241101/202411011212.6RM81BEd-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411011212.6RM81BEd-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:271:75: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void const *user_addr @@ got void [noderef] __user *to @@
mm/kmsan/hooks.c:271:75: sparse: expected void const *user_addr
mm/kmsan/hooks.c:271:75: sparse: got void [noderef] __user *to
mm/kmsan/hooks.c:280:50: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:306:59: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:319:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:325:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:421:78: sparse: sparse: Using plain integer as NULL pointer
vim +/__user +269 mm/kmsan/hooks.c
b073d7f8aee4ebf Alexander Potapenko 2022-09-15 247
75cf0290271bf6d Alexander Potapenko 2022-09-15 248 void kmsan_copy_to_user(void __user *to, const void *from, size_t to_copy,
75cf0290271bf6d Alexander Potapenko 2022-09-15 249 size_t left)
75cf0290271bf6d Alexander Potapenko 2022-09-15 250 {
75cf0290271bf6d Alexander Potapenko 2022-09-15 251 unsigned long ua_flags;
75cf0290271bf6d Alexander Potapenko 2022-09-15 252
75cf0290271bf6d Alexander Potapenko 2022-09-15 253 if (!kmsan_enabled || kmsan_in_runtime())
75cf0290271bf6d Alexander Potapenko 2022-09-15 254 return;
75cf0290271bf6d Alexander Potapenko 2022-09-15 255 /*
75cf0290271bf6d Alexander Potapenko 2022-09-15 256 * At this point we've copied the memory already. It's hard to check it
75cf0290271bf6d Alexander Potapenko 2022-09-15 257 * before copying, as the size of actually copied buffer is unknown.
75cf0290271bf6d Alexander Potapenko 2022-09-15 258 */
75cf0290271bf6d Alexander Potapenko 2022-09-15 259
75cf0290271bf6d Alexander Potapenko 2022-09-15 260 /* copy_to_user() may copy zero bytes. No need to check. */
75cf0290271bf6d Alexander Potapenko 2022-09-15 261 if (!to_copy)
75cf0290271bf6d Alexander Potapenko 2022-09-15 262 return;
75cf0290271bf6d Alexander Potapenko 2022-09-15 263 /* Or maybe copy_to_user() failed to copy anything. */
75cf0290271bf6d Alexander Potapenko 2022-09-15 264 if (to_copy <= left)
75cf0290271bf6d Alexander Potapenko 2022-09-15 265 return;
75cf0290271bf6d Alexander Potapenko 2022-09-15 266
75cf0290271bf6d Alexander Potapenko 2022-09-15 267 ua_flags = user_access_save();
f926e9326f3a79f Ilya Leoshkevich 2024-06-21 268 if (!IS_ENABLED(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) ||
f926e9326f3a79f Ilya Leoshkevich 2024-06-21 @269 (u64)to < TASK_SIZE) {
75cf0290271bf6d Alexander Potapenko 2022-09-15 270 /* This is a user memory access, check it. */
75cf0290271bf6d Alexander Potapenko 2022-09-15 271 kmsan_internal_check_memory((void *)from, to_copy - left, to,
75cf0290271bf6d Alexander Potapenko 2022-09-15 272 REASON_COPY_TO_USER);
75cf0290271bf6d Alexander Potapenko 2022-09-15 273 } else {
75cf0290271bf6d Alexander Potapenko 2022-09-15 274 /* Otherwise this is a kernel memory access. This happens when a
75cf0290271bf6d Alexander Potapenko 2022-09-15 275 * compat syscall passes an argument allocated on the kernel
75cf0290271bf6d Alexander Potapenko 2022-09-15 276 * stack to a real syscall.
75cf0290271bf6d Alexander Potapenko 2022-09-15 277 * Don't check anything, just copy the shadow of the copied
75cf0290271bf6d Alexander Potapenko 2022-09-15 278 * bytes.
75cf0290271bf6d Alexander Potapenko 2022-09-15 279 */
75cf0290271bf6d Alexander Potapenko 2022-09-15 280 kmsan_internal_memmove_metadata((void *)to, (void *)from,
75cf0290271bf6d Alexander Potapenko 2022-09-15 281 to_copy - left);
75cf0290271bf6d Alexander Potapenko 2022-09-15 282 }
75cf0290271bf6d Alexander Potapenko 2022-09-15 283 user_access_restore(ua_flags);
75cf0290271bf6d Alexander Potapenko 2022-09-15 284 }
75cf0290271bf6d Alexander Potapenko 2022-09-15 285 EXPORT_SYMBOL(kmsan_copy_to_user);
75cf0290271bf6d Alexander Potapenko 2022-09-15 286
:::::: The code at line 269 was first introduced by commit
:::::: f926e9326f3a79f7e01ac790e2361f44d8ca8320 kmsan: fix kmsan_copy_to_user() on arches with overlapping address spaces
:::::: TO: Ilya Leoshkevich <iii@linux.ibm.com>
:::::: CC: Andrew Morton <akpm@linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 9+ messages in thread
* mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
@ 2024-12-12 11:02 kernel test robot
0 siblings, 0 replies; 9+ messages in thread
From: kernel test robot @ 2024-12-12 11:02 UTC (permalink / raw)
To: Ilya Leoshkevich
Cc: oe-kbuild-all, linux-kernel, Andrew Morton,
Linux Memory Management List, Alexander Potapenko
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 231825b2e1ff6ba799c5eaf396d3ab2354e37c6b
commit: 3a8f6f3b469b4075919a3613e182f9a70df92d46 kmsan: enable on s390
date: 5 months ago
config: s390-randconfig-r121-20241212 (https://download.01.org/0day-ci/archive/20241212/202412121809.uLILCZRI-lkp@intel.com/config)
compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 2dc22615fd46ab2566d0f26d5ba234ab12dc4bf8)
reproduce: (https://download.01.org/0day-ci/archive/20241212/202412121809.uLILCZRI-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202412121809.uLILCZRI-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:271:75: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void const *user_addr @@ got void [noderef] __user *to @@
mm/kmsan/hooks.c:271:75: sparse: expected void const *user_addr
mm/kmsan/hooks.c:271:75: sparse: got void [noderef] __user *to
mm/kmsan/hooks.c:280:50: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:306:59: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:319:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:325:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:421:78: sparse: sparse: Using plain integer as NULL pointer
vim +/__user +269 mm/kmsan/hooks.c
b073d7f8aee4ebf Alexander Potapenko 2022-09-15 247
75cf0290271bf6d Alexander Potapenko 2022-09-15 248 void kmsan_copy_to_user(void __user *to, const void *from, size_t to_copy,
75cf0290271bf6d Alexander Potapenko 2022-09-15 249 size_t left)
75cf0290271bf6d Alexander Potapenko 2022-09-15 250 {
75cf0290271bf6d Alexander Potapenko 2022-09-15 251 unsigned long ua_flags;
75cf0290271bf6d Alexander Potapenko 2022-09-15 252
75cf0290271bf6d Alexander Potapenko 2022-09-15 253 if (!kmsan_enabled || kmsan_in_runtime())
75cf0290271bf6d Alexander Potapenko 2022-09-15 254 return;
75cf0290271bf6d Alexander Potapenko 2022-09-15 255 /*
75cf0290271bf6d Alexander Potapenko 2022-09-15 256 * At this point we've copied the memory already. It's hard to check it
75cf0290271bf6d Alexander Potapenko 2022-09-15 257 * before copying, as the size of actually copied buffer is unknown.
75cf0290271bf6d Alexander Potapenko 2022-09-15 258 */
75cf0290271bf6d Alexander Potapenko 2022-09-15 259
75cf0290271bf6d Alexander Potapenko 2022-09-15 260 /* copy_to_user() may copy zero bytes. No need to check. */
75cf0290271bf6d Alexander Potapenko 2022-09-15 261 if (!to_copy)
75cf0290271bf6d Alexander Potapenko 2022-09-15 262 return;
75cf0290271bf6d Alexander Potapenko 2022-09-15 263 /* Or maybe copy_to_user() failed to copy anything. */
75cf0290271bf6d Alexander Potapenko 2022-09-15 264 if (to_copy <= left)
75cf0290271bf6d Alexander Potapenko 2022-09-15 265 return;
75cf0290271bf6d Alexander Potapenko 2022-09-15 266
75cf0290271bf6d Alexander Potapenko 2022-09-15 267 ua_flags = user_access_save();
f926e9326f3a79f Ilya Leoshkevich 2024-06-21 268 if (!IS_ENABLED(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) ||
f926e9326f3a79f Ilya Leoshkevich 2024-06-21 @269 (u64)to < TASK_SIZE) {
75cf0290271bf6d Alexander Potapenko 2022-09-15 270 /* This is a user memory access, check it. */
75cf0290271bf6d Alexander Potapenko 2022-09-15 271 kmsan_internal_check_memory((void *)from, to_copy - left, to,
75cf0290271bf6d Alexander Potapenko 2022-09-15 272 REASON_COPY_TO_USER);
75cf0290271bf6d Alexander Potapenko 2022-09-15 273 } else {
75cf0290271bf6d Alexander Potapenko 2022-09-15 274 /* Otherwise this is a kernel memory access. This happens when a
75cf0290271bf6d Alexander Potapenko 2022-09-15 275 * compat syscall passes an argument allocated on the kernel
75cf0290271bf6d Alexander Potapenko 2022-09-15 276 * stack to a real syscall.
75cf0290271bf6d Alexander Potapenko 2022-09-15 277 * Don't check anything, just copy the shadow of the copied
75cf0290271bf6d Alexander Potapenko 2022-09-15 278 * bytes.
75cf0290271bf6d Alexander Potapenko 2022-09-15 279 */
75cf0290271bf6d Alexander Potapenko 2022-09-15 280 kmsan_internal_memmove_metadata((void *)to, (void *)from,
75cf0290271bf6d Alexander Potapenko 2022-09-15 281 to_copy - left);
75cf0290271bf6d Alexander Potapenko 2022-09-15 282 }
75cf0290271bf6d Alexander Potapenko 2022-09-15 283 user_access_restore(ua_flags);
75cf0290271bf6d Alexander Potapenko 2022-09-15 284 }
75cf0290271bf6d Alexander Potapenko 2022-09-15 285 EXPORT_SYMBOL(kmsan_copy_to_user);
75cf0290271bf6d Alexander Potapenko 2022-09-15 286
:::::: The code at line 269 was first introduced by commit
:::::: f926e9326f3a79f7e01ac790e2361f44d8ca8320 kmsan: fix kmsan_copy_to_user() on arches with overlapping address spaces
:::::: TO: Ilya Leoshkevich <iii@linux.ibm.com>
:::::: CC: Andrew Morton <akpm@linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 9+ messages in thread
* mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
@ 2025-01-28 19:42 kernel test robot
0 siblings, 0 replies; 9+ messages in thread
From: kernel test robot @ 2025-01-28 19:42 UTC (permalink / raw)
To: Ilya Leoshkevich
Cc: oe-kbuild-all, linux-kernel, Andrew Morton,
Linux Memory Management List, Alexander Potapenko
Hi Ilya,
First bad commit (maybe != root cause):
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: e2ee2e9b159094527ae7ad78058b1316f62fc5b7
commit: 3a8f6f3b469b4075919a3613e182f9a70df92d46 kmsan: enable on s390
date: 7 months ago
config: s390-randconfig-r132-20250126 (https://download.01.org/0day-ci/archive/20250129/202501290356.mlGVL2QZ-lkp@intel.com/config)
compiler: clang version 18.1.8 (https://github.com/llvm/llvm-project 3b5b5c1ec4a3095ab096dd780e84d7ab81f3d7ff)
reproduce: (https://download.01.org/0day-ci/archive/20250129/202501290356.mlGVL2QZ-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202501290356.mlGVL2QZ-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:271:75: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void const *user_addr @@ got void [noderef] __user *to @@
mm/kmsan/hooks.c:271:75: sparse: expected void const *user_addr
mm/kmsan/hooks.c:271:75: sparse: got void [noderef] __user *to
mm/kmsan/hooks.c:280:50: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:306:59: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:319:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:325:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:421:78: sparse: sparse: Using plain integer as NULL pointer
vim +/__user +269 mm/kmsan/hooks.c
b073d7f8aee4eb Alexander Potapenko 2022-09-15 247
75cf0290271bf6 Alexander Potapenko 2022-09-15 248 void kmsan_copy_to_user(void __user *to, const void *from, size_t to_copy,
75cf0290271bf6 Alexander Potapenko 2022-09-15 249 size_t left)
75cf0290271bf6 Alexander Potapenko 2022-09-15 250 {
75cf0290271bf6 Alexander Potapenko 2022-09-15 251 unsigned long ua_flags;
75cf0290271bf6 Alexander Potapenko 2022-09-15 252
75cf0290271bf6 Alexander Potapenko 2022-09-15 253 if (!kmsan_enabled || kmsan_in_runtime())
75cf0290271bf6 Alexander Potapenko 2022-09-15 254 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 255 /*
75cf0290271bf6 Alexander Potapenko 2022-09-15 256 * At this point we've copied the memory already. It's hard to check it
75cf0290271bf6 Alexander Potapenko 2022-09-15 257 * before copying, as the size of actually copied buffer is unknown.
75cf0290271bf6 Alexander Potapenko 2022-09-15 258 */
75cf0290271bf6 Alexander Potapenko 2022-09-15 259
75cf0290271bf6 Alexander Potapenko 2022-09-15 260 /* copy_to_user() may copy zero bytes. No need to check. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 261 if (!to_copy)
75cf0290271bf6 Alexander Potapenko 2022-09-15 262 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 263 /* Or maybe copy_to_user() failed to copy anything. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 264 if (to_copy <= left)
75cf0290271bf6 Alexander Potapenko 2022-09-15 265 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 266
75cf0290271bf6 Alexander Potapenko 2022-09-15 267 ua_flags = user_access_save();
f926e9326f3a79 Ilya Leoshkevich 2024-06-21 268 if (!IS_ENABLED(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) ||
f926e9326f3a79 Ilya Leoshkevich 2024-06-21 @269 (u64)to < TASK_SIZE) {
75cf0290271bf6 Alexander Potapenko 2022-09-15 270 /* This is a user memory access, check it. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 271 kmsan_internal_check_memory((void *)from, to_copy - left, to,
75cf0290271bf6 Alexander Potapenko 2022-09-15 272 REASON_COPY_TO_USER);
75cf0290271bf6 Alexander Potapenko 2022-09-15 273 } else {
75cf0290271bf6 Alexander Potapenko 2022-09-15 274 /* Otherwise this is a kernel memory access. This happens when a
75cf0290271bf6 Alexander Potapenko 2022-09-15 275 * compat syscall passes an argument allocated on the kernel
75cf0290271bf6 Alexander Potapenko 2022-09-15 276 * stack to a real syscall.
75cf0290271bf6 Alexander Potapenko 2022-09-15 277 * Don't check anything, just copy the shadow of the copied
75cf0290271bf6 Alexander Potapenko 2022-09-15 278 * bytes.
75cf0290271bf6 Alexander Potapenko 2022-09-15 279 */
75cf0290271bf6 Alexander Potapenko 2022-09-15 280 kmsan_internal_memmove_metadata((void *)to, (void *)from,
75cf0290271bf6 Alexander Potapenko 2022-09-15 281 to_copy - left);
75cf0290271bf6 Alexander Potapenko 2022-09-15 282 }
75cf0290271bf6 Alexander Potapenko 2022-09-15 283 user_access_restore(ua_flags);
75cf0290271bf6 Alexander Potapenko 2022-09-15 284 }
75cf0290271bf6 Alexander Potapenko 2022-09-15 285 EXPORT_SYMBOL(kmsan_copy_to_user);
75cf0290271bf6 Alexander Potapenko 2022-09-15 286
:::::: The code at line 269 was first introduced by commit
:::::: f926e9326f3a79f7e01ac790e2361f44d8ca8320 kmsan: fix kmsan_copy_to_user() on arches with overlapping address spaces
:::::: TO: Ilya Leoshkevich <iii@linux.ibm.com>
:::::: CC: Andrew Morton <akpm@linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 9+ messages in thread
* mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
@ 2025-03-02 23:47 kernel test robot
0 siblings, 0 replies; 9+ messages in thread
From: kernel test robot @ 2025-03-02 23:47 UTC (permalink / raw)
To: Ilya Leoshkevich
Cc: oe-kbuild-all, linux-kernel, Andrew Morton,
Linux Memory Management List, Alexander Potapenko
Hi Ilya,
First bad commit (maybe != root cause):
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 7eb172143d5508b4da468ed59ee857c6e5e01da6
commit: 3a8f6f3b469b4075919a3613e182f9a70df92d46 kmsan: enable on s390
date: 8 months ago
config: s390-randconfig-r122-20250303 (https://download.01.org/0day-ci/archive/20250303/202503030742.0cGEybrx-lkp@intel.com/config)
compiler: clang version 19.1.7 (https://github.com/llvm/llvm-project cd708029e0b2869e80abe31ddb175f7c35361f90)
reproduce: (https://download.01.org/0day-ci/archive/20250303/202503030742.0cGEybrx-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202503030742.0cGEybrx-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:271:75: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void const *user_addr @@ got void [noderef] __user *to @@
mm/kmsan/hooks.c:271:75: sparse: expected void const *user_addr
mm/kmsan/hooks.c:271:75: sparse: got void [noderef] __user *to
mm/kmsan/hooks.c:280:50: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:306:59: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:319:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:325:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:421:78: sparse: sparse: Using plain integer as NULL pointer
vim +/__user +269 mm/kmsan/hooks.c
b073d7f8aee4eb Alexander Potapenko 2022-09-15 247
75cf0290271bf6 Alexander Potapenko 2022-09-15 248 void kmsan_copy_to_user(void __user *to, const void *from, size_t to_copy,
75cf0290271bf6 Alexander Potapenko 2022-09-15 249 size_t left)
75cf0290271bf6 Alexander Potapenko 2022-09-15 250 {
75cf0290271bf6 Alexander Potapenko 2022-09-15 251 unsigned long ua_flags;
75cf0290271bf6 Alexander Potapenko 2022-09-15 252
75cf0290271bf6 Alexander Potapenko 2022-09-15 253 if (!kmsan_enabled || kmsan_in_runtime())
75cf0290271bf6 Alexander Potapenko 2022-09-15 254 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 255 /*
75cf0290271bf6 Alexander Potapenko 2022-09-15 256 * At this point we've copied the memory already. It's hard to check it
75cf0290271bf6 Alexander Potapenko 2022-09-15 257 * before copying, as the size of actually copied buffer is unknown.
75cf0290271bf6 Alexander Potapenko 2022-09-15 258 */
75cf0290271bf6 Alexander Potapenko 2022-09-15 259
75cf0290271bf6 Alexander Potapenko 2022-09-15 260 /* copy_to_user() may copy zero bytes. No need to check. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 261 if (!to_copy)
75cf0290271bf6 Alexander Potapenko 2022-09-15 262 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 263 /* Or maybe copy_to_user() failed to copy anything. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 264 if (to_copy <= left)
75cf0290271bf6 Alexander Potapenko 2022-09-15 265 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 266
75cf0290271bf6 Alexander Potapenko 2022-09-15 267 ua_flags = user_access_save();
f926e9326f3a79 Ilya Leoshkevich 2024-06-21 268 if (!IS_ENABLED(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) ||
f926e9326f3a79 Ilya Leoshkevich 2024-06-21 @269 (u64)to < TASK_SIZE) {
75cf0290271bf6 Alexander Potapenko 2022-09-15 270 /* This is a user memory access, check it. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 271 kmsan_internal_check_memory((void *)from, to_copy - left, to,
75cf0290271bf6 Alexander Potapenko 2022-09-15 272 REASON_COPY_TO_USER);
75cf0290271bf6 Alexander Potapenko 2022-09-15 273 } else {
75cf0290271bf6 Alexander Potapenko 2022-09-15 274 /* Otherwise this is a kernel memory access. This happens when a
75cf0290271bf6 Alexander Potapenko 2022-09-15 275 * compat syscall passes an argument allocated on the kernel
75cf0290271bf6 Alexander Potapenko 2022-09-15 276 * stack to a real syscall.
75cf0290271bf6 Alexander Potapenko 2022-09-15 277 * Don't check anything, just copy the shadow of the copied
75cf0290271bf6 Alexander Potapenko 2022-09-15 278 * bytes.
75cf0290271bf6 Alexander Potapenko 2022-09-15 279 */
75cf0290271bf6 Alexander Potapenko 2022-09-15 280 kmsan_internal_memmove_metadata((void *)to, (void *)from,
75cf0290271bf6 Alexander Potapenko 2022-09-15 281 to_copy - left);
75cf0290271bf6 Alexander Potapenko 2022-09-15 282 }
75cf0290271bf6 Alexander Potapenko 2022-09-15 283 user_access_restore(ua_flags);
75cf0290271bf6 Alexander Potapenko 2022-09-15 284 }
75cf0290271bf6 Alexander Potapenko 2022-09-15 285 EXPORT_SYMBOL(kmsan_copy_to_user);
75cf0290271bf6 Alexander Potapenko 2022-09-15 286
:::::: The code at line 269 was first introduced by commit
:::::: f926e9326f3a79f7e01ac790e2361f44d8ca8320 kmsan: fix kmsan_copy_to_user() on arches with overlapping address spaces
:::::: TO: Ilya Leoshkevich <iii@linux.ibm.com>
:::::: CC: Andrew Morton <akpm@linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 9+ messages in thread
* mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
@ 2025-04-22 8:15 kernel test robot
0 siblings, 0 replies; 9+ messages in thread
From: kernel test robot @ 2025-04-22 8:15 UTC (permalink / raw)
To: Ilya Leoshkevich
Cc: oe-kbuild-all, linux-kernel, Andrew Morton,
Linux Memory Management List, Alexander Potapenko
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: a33b5a08cbbdd7aadff95f40cbb45ab86841679e
commit: 3a8f6f3b469b4075919a3613e182f9a70df92d46 kmsan: enable on s390
date: 10 months ago
config: s390-randconfig-r113-20250422 (https://download.01.org/0day-ci/archive/20250422/202504221600.LRuSAGXA-lkp@intel.com/config)
compiler: clang version 21.0.0git (https://github.com/llvm/llvm-project f819f46284f2a79790038e1f6649172789734ae8)
reproduce: (https://download.01.org/0day-ci/archive/20250422/202504221600.LRuSAGXA-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202504221600.LRuSAGXA-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:271:75: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void const *user_addr @@ got void [noderef] __user *to @@
mm/kmsan/hooks.c:271:75: sparse: expected void const *user_addr
mm/kmsan/hooks.c:271:75: sparse: got void [noderef] __user *to
mm/kmsan/hooks.c:280:50: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:306:59: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:319:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:325:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:421:78: sparse: sparse: Using plain integer as NULL pointer
vim +/__user +269 mm/kmsan/hooks.c
b073d7f8aee4eb Alexander Potapenko 2022-09-15 247
75cf0290271bf6 Alexander Potapenko 2022-09-15 248 void kmsan_copy_to_user(void __user *to, const void *from, size_t to_copy,
75cf0290271bf6 Alexander Potapenko 2022-09-15 249 size_t left)
75cf0290271bf6 Alexander Potapenko 2022-09-15 250 {
75cf0290271bf6 Alexander Potapenko 2022-09-15 251 unsigned long ua_flags;
75cf0290271bf6 Alexander Potapenko 2022-09-15 252
75cf0290271bf6 Alexander Potapenko 2022-09-15 253 if (!kmsan_enabled || kmsan_in_runtime())
75cf0290271bf6 Alexander Potapenko 2022-09-15 254 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 255 /*
75cf0290271bf6 Alexander Potapenko 2022-09-15 256 * At this point we've copied the memory already. It's hard to check it
75cf0290271bf6 Alexander Potapenko 2022-09-15 257 * before copying, as the size of actually copied buffer is unknown.
75cf0290271bf6 Alexander Potapenko 2022-09-15 258 */
75cf0290271bf6 Alexander Potapenko 2022-09-15 259
75cf0290271bf6 Alexander Potapenko 2022-09-15 260 /* copy_to_user() may copy zero bytes. No need to check. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 261 if (!to_copy)
75cf0290271bf6 Alexander Potapenko 2022-09-15 262 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 263 /* Or maybe copy_to_user() failed to copy anything. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 264 if (to_copy <= left)
75cf0290271bf6 Alexander Potapenko 2022-09-15 265 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 266
75cf0290271bf6 Alexander Potapenko 2022-09-15 267 ua_flags = user_access_save();
f926e9326f3a79 Ilya Leoshkevich 2024-06-21 268 if (!IS_ENABLED(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) ||
f926e9326f3a79 Ilya Leoshkevich 2024-06-21 @269 (u64)to < TASK_SIZE) {
75cf0290271bf6 Alexander Potapenko 2022-09-15 270 /* This is a user memory access, check it. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 271 kmsan_internal_check_memory((void *)from, to_copy - left, to,
75cf0290271bf6 Alexander Potapenko 2022-09-15 272 REASON_COPY_TO_USER);
75cf0290271bf6 Alexander Potapenko 2022-09-15 273 } else {
75cf0290271bf6 Alexander Potapenko 2022-09-15 274 /* Otherwise this is a kernel memory access. This happens when a
75cf0290271bf6 Alexander Potapenko 2022-09-15 275 * compat syscall passes an argument allocated on the kernel
75cf0290271bf6 Alexander Potapenko 2022-09-15 276 * stack to a real syscall.
75cf0290271bf6 Alexander Potapenko 2022-09-15 277 * Don't check anything, just copy the shadow of the copied
75cf0290271bf6 Alexander Potapenko 2022-09-15 278 * bytes.
75cf0290271bf6 Alexander Potapenko 2022-09-15 279 */
75cf0290271bf6 Alexander Potapenko 2022-09-15 280 kmsan_internal_memmove_metadata((void *)to, (void *)from,
75cf0290271bf6 Alexander Potapenko 2022-09-15 281 to_copy - left);
75cf0290271bf6 Alexander Potapenko 2022-09-15 282 }
75cf0290271bf6 Alexander Potapenko 2022-09-15 283 user_access_restore(ua_flags);
75cf0290271bf6 Alexander Potapenko 2022-09-15 284 }
75cf0290271bf6 Alexander Potapenko 2022-09-15 285 EXPORT_SYMBOL(kmsan_copy_to_user);
75cf0290271bf6 Alexander Potapenko 2022-09-15 286
:::::: The code at line 269 was first introduced by commit
:::::: f926e9326f3a79f7e01ac790e2361f44d8ca8320 kmsan: fix kmsan_copy_to_user() on arches with overlapping address spaces
:::::: TO: Ilya Leoshkevich <iii@linux.ibm.com>
:::::: CC: Andrew Morton <akpm@linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 9+ messages in thread
* mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
@ 2025-06-13 4:28 kernel test robot
2025-06-15 8:11 ` David Laight
0 siblings, 1 reply; 9+ messages in thread
From: kernel test robot @ 2025-06-13 4:28 UTC (permalink / raw)
To: Ilya Leoshkevich
Cc: oe-kbuild-all, linux-kernel, Andrew Morton,
Linux Memory Management List, Alexander Potapenko
Hi Ilya,
First bad commit (maybe != root cause):
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 27605c8c0f69e319df156b471974e4e223035378
commit: 3a8f6f3b469b4075919a3613e182f9a70df92d46 kmsan: enable on s390
date: 11 months ago
config: s390-randconfig-r132-20250613 (https://download.01.org/0day-ci/archive/20250613/202506131242.qB8fUSlP-lkp@intel.com/config)
compiler: clang version 21.0.0git (https://github.com/llvm/llvm-project f819f46284f2a79790038e1f6649172789734ae8)
reproduce: (https://download.01.org/0day-ci/archive/20250613/202506131242.qB8fUSlP-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202506131242.qB8fUSlP-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:271:75: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void const *user_addr @@ got void [noderef] __user *to @@
mm/kmsan/hooks.c:271:75: sparse: expected void const *user_addr
mm/kmsan/hooks.c:271:75: sparse: got void [noderef] __user *to
mm/kmsan/hooks.c:280:50: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:306:59: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:319:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:325:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:421:78: sparse: sparse: Using plain integer as NULL pointer
vim +/__user +269 mm/kmsan/hooks.c
b073d7f8aee4eb Alexander Potapenko 2022-09-15 247
75cf0290271bf6 Alexander Potapenko 2022-09-15 248 void kmsan_copy_to_user(void __user *to, const void *from, size_t to_copy,
75cf0290271bf6 Alexander Potapenko 2022-09-15 249 size_t left)
75cf0290271bf6 Alexander Potapenko 2022-09-15 250 {
75cf0290271bf6 Alexander Potapenko 2022-09-15 251 unsigned long ua_flags;
75cf0290271bf6 Alexander Potapenko 2022-09-15 252
75cf0290271bf6 Alexander Potapenko 2022-09-15 253 if (!kmsan_enabled || kmsan_in_runtime())
75cf0290271bf6 Alexander Potapenko 2022-09-15 254 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 255 /*
75cf0290271bf6 Alexander Potapenko 2022-09-15 256 * At this point we've copied the memory already. It's hard to check it
75cf0290271bf6 Alexander Potapenko 2022-09-15 257 * before copying, as the size of actually copied buffer is unknown.
75cf0290271bf6 Alexander Potapenko 2022-09-15 258 */
75cf0290271bf6 Alexander Potapenko 2022-09-15 259
75cf0290271bf6 Alexander Potapenko 2022-09-15 260 /* copy_to_user() may copy zero bytes. No need to check. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 261 if (!to_copy)
75cf0290271bf6 Alexander Potapenko 2022-09-15 262 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 263 /* Or maybe copy_to_user() failed to copy anything. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 264 if (to_copy <= left)
75cf0290271bf6 Alexander Potapenko 2022-09-15 265 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 266
75cf0290271bf6 Alexander Potapenko 2022-09-15 267 ua_flags = user_access_save();
f926e9326f3a79 Ilya Leoshkevich 2024-06-21 268 if (!IS_ENABLED(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) ||
f926e9326f3a79 Ilya Leoshkevich 2024-06-21 @269 (u64)to < TASK_SIZE) {
75cf0290271bf6 Alexander Potapenko 2022-09-15 270 /* This is a user memory access, check it. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 271 kmsan_internal_check_memory((void *)from, to_copy - left, to,
75cf0290271bf6 Alexander Potapenko 2022-09-15 272 REASON_COPY_TO_USER);
75cf0290271bf6 Alexander Potapenko 2022-09-15 273 } else {
75cf0290271bf6 Alexander Potapenko 2022-09-15 274 /* Otherwise this is a kernel memory access. This happens when a
75cf0290271bf6 Alexander Potapenko 2022-09-15 275 * compat syscall passes an argument allocated on the kernel
75cf0290271bf6 Alexander Potapenko 2022-09-15 276 * stack to a real syscall.
75cf0290271bf6 Alexander Potapenko 2022-09-15 277 * Don't check anything, just copy the shadow of the copied
75cf0290271bf6 Alexander Potapenko 2022-09-15 278 * bytes.
75cf0290271bf6 Alexander Potapenko 2022-09-15 279 */
75cf0290271bf6 Alexander Potapenko 2022-09-15 280 kmsan_internal_memmove_metadata((void *)to, (void *)from,
75cf0290271bf6 Alexander Potapenko 2022-09-15 281 to_copy - left);
75cf0290271bf6 Alexander Potapenko 2022-09-15 282 }
75cf0290271bf6 Alexander Potapenko 2022-09-15 283 user_access_restore(ua_flags);
75cf0290271bf6 Alexander Potapenko 2022-09-15 284 }
75cf0290271bf6 Alexander Potapenko 2022-09-15 285 EXPORT_SYMBOL(kmsan_copy_to_user);
75cf0290271bf6 Alexander Potapenko 2022-09-15 286
:::::: The code at line 269 was first introduced by commit
:::::: f926e9326f3a79f7e01ac790e2361f44d8ca8320 kmsan: fix kmsan_copy_to_user() on arches with overlapping address spaces
:::::: TO: Ilya Leoshkevich <iii@linux.ibm.com>
:::::: CC: Andrew Morton <akpm@linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
2025-06-13 4:28 mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression kernel test robot
@ 2025-06-15 8:11 ` David Laight
0 siblings, 0 replies; 9+ messages in thread
From: David Laight @ 2025-06-15 8:11 UTC (permalink / raw)
To: kernel test robot
Cc: Ilya Leoshkevich, oe-kbuild-all, linux-kernel, Andrew Morton,
Linux Memory Management List, Alexander Potapenko
On Fri, 13 Jun 2025 12:28:55 +0800
Not directly related but...
....
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 267 ua_flags = user_access_save();
> f926e9326f3a79 Ilya Leoshkevich 2024-06-21 268 if (!IS_ENABLED(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) ||
> f926e9326f3a79 Ilya Leoshkevich 2024-06-21 @269 (u64)to < TASK_SIZE) {
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 270 /* This is a user memory access, check it. */
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 271 kmsan_internal_check_memory((void *)from, to_copy - left, to,
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 272 REASON_COPY_TO_USER);
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 273 } else {
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 274 /* Otherwise this is a kernel memory access. This happens when a
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 275 * compat syscall passes an argument allocated on the kernel
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 276 * stack to a real syscall.
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 277 * Don't check anything, just copy the shadow of the copied
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 278 * bytes.
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 279 */
Isn't that comment just wrong?
Compat syscalls just don't do that any more.
They might have done it in the past before setfs(KERNEL_DS) got nuked.
So the 'else' clause can never happen and the test nuked.
So anything here is always 'user' (or will have failed access_ok()).
I think that also means the test can be done before the copy_to_user() itself
since, contrary to the earlier comment (trimmed) all of the kernel memory
that might be copied needs to have valid data.
(Unlike copy_from_user() when only the written part need to be marked
as containing valid data.)
David
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 280 kmsan_internal_memmove_metadata((void *)to, (void *)from,
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 281 to_copy - left);
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 282 }
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 283 user_access_restore(ua_flags);
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 284 }
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 285 EXPORT_SYMBOL(kmsan_copy_to_user);
> 75cf0290271bf6 Alexander Potapenko 2022-09-15 286
>
> :::::: The code at line 269 was first introduced by commit
> :::::: f926e9326f3a79f7e01ac790e2361f44d8ca8320 kmsan: fix kmsan_copy_to_user() on arches with overlapping address spaces
>
> :::::: TO: Ilya Leoshkevich <iii@linux.ibm.com>
> :::::: CC: Andrew Morton <akpm@linux-foundation.org>
>
^ permalink raw reply [flat|nested] 9+ messages in thread
* mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
@ 2025-07-30 2:01 kernel test robot
0 siblings, 0 replies; 9+ messages in thread
From: kernel test robot @ 2025-07-30 2:01 UTC (permalink / raw)
To: Ilya Leoshkevich
Cc: oe-kbuild-all, linux-kernel, Andrew Morton,
Linux Memory Management List, Alexander Potapenko
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 14bed9bc81bae64db98349319f367bfc7dab0afd
commit: 3a8f6f3b469b4075919a3613e182f9a70df92d46 kmsan: enable on s390
date: 1 year, 1 month ago
config: s390-randconfig-r111-20250730 (https://download.01.org/0day-ci/archive/20250730/202507300944.NePjNXZ2-lkp@intel.com/config)
compiler: clang version 22.0.0git (https://github.com/llvm/llvm-project bcd0d972247154336dd1321f1fded818e46671d1)
reproduce: (https://download.01.org/0day-ci/archive/20250730/202507300944.NePjNXZ2-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202507300944.NePjNXZ2-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:271:75: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void const *user_addr @@ got void [noderef] __user *to @@
mm/kmsan/hooks.c:271:75: sparse: expected void const *user_addr
mm/kmsan/hooks.c:271:75: sparse: got void [noderef] __user *to
mm/kmsan/hooks.c:280:50: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:306:59: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:319:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:325:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:421:78: sparse: sparse: Using plain integer as NULL pointer
vim +/__user +269 mm/kmsan/hooks.c
b073d7f8aee4eb Alexander Potapenko 2022-09-15 247
75cf0290271bf6 Alexander Potapenko 2022-09-15 248 void kmsan_copy_to_user(void __user *to, const void *from, size_t to_copy,
75cf0290271bf6 Alexander Potapenko 2022-09-15 249 size_t left)
75cf0290271bf6 Alexander Potapenko 2022-09-15 250 {
75cf0290271bf6 Alexander Potapenko 2022-09-15 251 unsigned long ua_flags;
75cf0290271bf6 Alexander Potapenko 2022-09-15 252
75cf0290271bf6 Alexander Potapenko 2022-09-15 253 if (!kmsan_enabled || kmsan_in_runtime())
75cf0290271bf6 Alexander Potapenko 2022-09-15 254 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 255 /*
75cf0290271bf6 Alexander Potapenko 2022-09-15 256 * At this point we've copied the memory already. It's hard to check it
75cf0290271bf6 Alexander Potapenko 2022-09-15 257 * before copying, as the size of actually copied buffer is unknown.
75cf0290271bf6 Alexander Potapenko 2022-09-15 258 */
75cf0290271bf6 Alexander Potapenko 2022-09-15 259
75cf0290271bf6 Alexander Potapenko 2022-09-15 260 /* copy_to_user() may copy zero bytes. No need to check. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 261 if (!to_copy)
75cf0290271bf6 Alexander Potapenko 2022-09-15 262 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 263 /* Or maybe copy_to_user() failed to copy anything. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 264 if (to_copy <= left)
75cf0290271bf6 Alexander Potapenko 2022-09-15 265 return;
75cf0290271bf6 Alexander Potapenko 2022-09-15 266
75cf0290271bf6 Alexander Potapenko 2022-09-15 267 ua_flags = user_access_save();
f926e9326f3a79 Ilya Leoshkevich 2024-06-21 268 if (!IS_ENABLED(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) ||
f926e9326f3a79 Ilya Leoshkevich 2024-06-21 @269 (u64)to < TASK_SIZE) {
75cf0290271bf6 Alexander Potapenko 2022-09-15 270 /* This is a user memory access, check it. */
75cf0290271bf6 Alexander Potapenko 2022-09-15 271 kmsan_internal_check_memory((void *)from, to_copy - left, to,
75cf0290271bf6 Alexander Potapenko 2022-09-15 272 REASON_COPY_TO_USER);
75cf0290271bf6 Alexander Potapenko 2022-09-15 273 } else {
75cf0290271bf6 Alexander Potapenko 2022-09-15 274 /* Otherwise this is a kernel memory access. This happens when a
75cf0290271bf6 Alexander Potapenko 2022-09-15 275 * compat syscall passes an argument allocated on the kernel
75cf0290271bf6 Alexander Potapenko 2022-09-15 276 * stack to a real syscall.
75cf0290271bf6 Alexander Potapenko 2022-09-15 277 * Don't check anything, just copy the shadow of the copied
75cf0290271bf6 Alexander Potapenko 2022-09-15 278 * bytes.
75cf0290271bf6 Alexander Potapenko 2022-09-15 279 */
75cf0290271bf6 Alexander Potapenko 2022-09-15 280 kmsan_internal_memmove_metadata((void *)to, (void *)from,
75cf0290271bf6 Alexander Potapenko 2022-09-15 281 to_copy - left);
75cf0290271bf6 Alexander Potapenko 2022-09-15 282 }
75cf0290271bf6 Alexander Potapenko 2022-09-15 283 user_access_restore(ua_flags);
75cf0290271bf6 Alexander Potapenko 2022-09-15 284 }
75cf0290271bf6 Alexander Potapenko 2022-09-15 285 EXPORT_SYMBOL(kmsan_copy_to_user);
75cf0290271bf6 Alexander Potapenko 2022-09-15 286
:::::: The code at line 269 was first introduced by commit
:::::: f926e9326f3a79f7e01ac790e2361f44d8ca8320 kmsan: fix kmsan_copy_to_user() on arches with overlapping address spaces
:::::: TO: Ilya Leoshkevich <iii@linux.ibm.com>
:::::: CC: Andrew Morton <akpm@linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2025-07-30 2:02 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-06-13 4:28 mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression kernel test robot
2025-06-15 8:11 ` David Laight
-- strict thread matches above, loose matches on Subject: below --
2025-07-30 2:01 kernel test robot
2025-04-22 8:15 kernel test robot
2025-03-02 23:47 kernel test robot
2025-01-28 19:42 kernel test robot
2024-12-12 11:02 kernel test robot
2024-11-01 4:56 kernel test robot
2024-09-22 11:36 kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).