[PATCH 0/2] Fix warnings with recent smatch

[PATCH 0/2] Fix warnings with recent smatch

[Ricardo Ribalda]

Recent versions of smatch are more exhaustive while running typeof() [1].
This has triggered new errors in media-ci.

This series takes care of them following Dan's suggestion [2].

[1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f
[2] https://lore.kernel.org/all/CANiDSCuizbMt77XfrzGPMa3Biai5TF1vcs+C5qdhYoLrP=9b3g@mail.gmail.com/

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
Ricardo Ribalda (2):
      rcu: Fix casting while dereferencing rcu pointers
      x86/uaccess: Fix casting in put_user

 arch/x86/include/asm/uaccess.h |  4 ++--
 include/linux/rcupdate.h       | 10 +++++-----
 2 files changed, 7 insertions(+), 7 deletions(-)
---
base-commit: 66498c75b4f8017f62d720d9b59675bdf3abce91
change-id: 20260825-unqual-25d9ee74fd10

Best regards,
-- 
Ricardo Ribalda <ribalda@chromium.org>

[PATCH 1/2] rcu: Fix casting while dereferencing rcu pointers

[Ricardo Ribalda]

Recent versions of smatch preserved the address space qualifiers with
typeof()[1].

This fix has discovered an invalid casting in rcu dereference logic.

This patch fixes tens of smatch errors like the following:
./include/trace/events/vb2.h:46:1: warning: incorrect type in assignment (different address spaces)
./include/trace/events/vb2.h:46:1:    expected struct tracepoint_func *it_func_ptr
./include/trace/events/vb2.h:46:1:    got struct tracepoint_func __rcu *

[1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
 include/linux/rcupdate.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 44c07a66edff..80276cedda80 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -488,7 +488,7 @@ static __always_inline bool lockdep_assert_rcu_helper(bool c, const struct __ctx
 context_unsafe(								\
 	typeof(*p) *local = (typeof(*p) *__force)(p);			\
 	rcu_check_sparse(p, __rcu);					\
-	((typeof(*p) __force __kernel *)(local))			\
+	((TYPEOF_UNQUAL(*p) __force __kernel *)(local))			\
 )
 /**
  * unrcu_pointer - mark a pointer as not being RCU protected
@@ -503,7 +503,7 @@ context_unsafe(								\
 ({ \
 	typeof(*p) *local = (typeof(*p) *__force)READ_ONCE(p); \
 	rcu_check_sparse(p, space); \
-	((typeof(*p) __force __kernel *)(local)); \
+	((TYPEOF_UNQUAL(*p) __force __kernel *)(local)); \
 }) )
 #define __rcu_dereference_check(p, local, c, space) \
 ({ \
@@ -511,19 +511,19 @@ context_unsafe(								\
 	typeof(*p) *local = (typeof(*p) *__force)READ_ONCE(p); \
 	RCU_LOCKDEP_WARN(!(c), "suspicious rcu_dereference_check() usage"); \
 	rcu_check_sparse(p, space); \
-	((typeof(*p) __force __kernel *)(local)); \
+	((TYPEOF_UNQUAL(*p) __force __kernel *)(local)); \
 })
 #define __rcu_dereference_protected(p, local, c, space) \
 ({ \
 	RCU_LOCKDEP_WARN(!(c), "suspicious rcu_dereference_protected() usage"); \
 	rcu_check_sparse(p, space); \
-	((typeof(*p) __force __kernel *)(p)); \
+	((TYPEOF_UNQUAL(*p) __force __kernel *)(p)); \
 })
 #define __rcu_dereference_raw(p, local) \
 ({ \
 	/* Dependency order vs. p above. */ \
 	typeof(p) local = READ_ONCE(p); \
-	((typeof(*p) __force __kernel *)(local)); \
+	((TYPEOF_UNQUAL(*p) __force __kernel *)(local)); \
 })
 #define rcu_dereference_raw(p) __rcu_dereference_raw(p, __UNIQUE_ID(rcu))
 

-- 
2.55.0.897.gb25b4bd76c-goog

Re: [PATCH 1/2] rcu: Fix casting while dereferencing rcu pointers

[David Laight]

On Tue, 25 Aug 2026 20:02:10 +0000
Ricardo Ribalda <ribalda@chromium.org> wrote:

> Recent versions of smatch preserved the address space qualifiers with
> typeof()[1].
> 
> This fix has discovered an invalid casting in rcu dereference logic.
> 
> This patch fixes tens of smatch errors like the following:
> ./include/trace/events/vb2.h:46:1: warning: incorrect type in assignment (different address spaces)
> ./include/trace/events/vb2.h:46:1:    expected struct tracepoint_func *it_func_ptr
> ./include/trace/events/vb2.h:46:1:    got struct tracepoint_func __rcu *
> 
> [1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f
> 
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> ---
>  include/linux/rcupdate.h | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)
> 
> diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
> index 44c07a66edff..80276cedda80 100644
> --- a/include/linux/rcupdate.h
> +++ b/include/linux/rcupdate.h
> @@ -488,7 +488,7 @@ static __always_inline bool lockdep_assert_rcu_helper(bool c, const struct __ctx
>  context_unsafe(								\
>  	typeof(*p) *local = (typeof(*p) *__force)(p);			\
>  	rcu_check_sparse(p, __rcu);					\
> -	((typeof(*p) __force __kernel *)(local))			\
> +	((TYPEOF_UNQUAL(*p) __force __kernel *)(local))			\

Ugg... TYPEOF_UNQUAL() is absolutely horrid...
When __CHECKER__ is undefined the whole thing is just (p).

I suspect reducing all the definitions would measurably improve
kernel compile time (even before these changes).

David

>  )
>  /**
>   * unrcu_pointer - mark a pointer as not being RCU protected
> @@ -503,7 +503,7 @@ context_unsafe(								\
>  ({ \
>  	typeof(*p) *local = (typeof(*p) *__force)READ_ONCE(p); \
>  	rcu_check_sparse(p, space); \
> -	((typeof(*p) __force __kernel *)(local)); \
> +	((TYPEOF_UNQUAL(*p) __force __kernel *)(local)); \
>  }) )
>  #define __rcu_dereference_check(p, local, c, space) \
>  ({ \
> @@ -511,19 +511,19 @@ context_unsafe(								\
>  	typeof(*p) *local = (typeof(*p) *__force)READ_ONCE(p); \
>  	RCU_LOCKDEP_WARN(!(c), "suspicious rcu_dereference_check() usage"); \
>  	rcu_check_sparse(p, space); \
> -	((typeof(*p) __force __kernel *)(local)); \
> +	((TYPEOF_UNQUAL(*p) __force __kernel *)(local)); \
>  })
>  #define __rcu_dereference_protected(p, local, c, space) \
>  ({ \
>  	RCU_LOCKDEP_WARN(!(c), "suspicious rcu_dereference_protected() usage"); \
>  	rcu_check_sparse(p, space); \
> -	((typeof(*p) __force __kernel *)(p)); \
> +	((TYPEOF_UNQUAL(*p) __force __kernel *)(p)); \
>  })
>  #define __rcu_dereference_raw(p, local) \
>  ({ \
>  	/* Dependency order vs. p above. */ \
>  	typeof(p) local = READ_ONCE(p); \
> -	((typeof(*p) __force __kernel *)(local)); \
> +	((TYPEOF_UNQUAL(*p) __force __kernel *)(local)); \
>  })
>  #define rcu_dereference_raw(p) __rcu_dereference_raw(p, __UNIQUE_ID(rcu))
>  
> 

[PATCH 2/2] x86/uaccess: Fix casting in put_user

[Ricardo Ribalda]

Recent versions of smatch preserved the address space qualifiers with
typeof()[1].

This fix has discovered an invalid casting in put_user.

This patch fixes tens of smatch errors like the following:
drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *

[1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f

Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
 arch/x86/include/asm/uaccess.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 3a0dd3c2b233..4e576c0b9131 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -172,7 +172,7 @@ extern void __put_user_nocheck_8(void);
 	int __ret_pu;							\
 	void __user *__ptr_pu;						\
 	register __typeof__(*(ptr)) __val_pu asm("%"_ASM_AX);		\
-	__typeof__(*(ptr)) __x = (x); /* eval x once */			\
+	TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */		\
 	__typeof__(ptr) __ptr = (ptr); /* eval ptr once */		\
 	__chk_user_ptr(__ptr);						\
 	__ptr_pu = __ptr;						\
@@ -231,7 +231,7 @@ extern void __put_user_nocheck_8(void);
 
 #define __put_user_size(x, ptr, size, label)				\
 do {									\
-	__typeof__(*(ptr)) __x = (x); /* eval x once */			\
+	TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */		\
 	__typeof__(ptr) __ptr = (ptr); /* eval ptr once */		\
 	__chk_user_ptr(__ptr);						\
 	switch (size) {							\

-- 
2.55.0.897.gb25b4bd76c-goog

Re: [PATCH 2/2] x86/uaccess: Fix casting in put_user

[Dave Hansen]

On 8/25/26 13:02, Ricardo Ribalda wrote:
> Recent versions of smatch preserved the address space qualifiers with
> typeof()[1].
> 
> This fix has discovered an invalid casting in put_user.
> 
> This patch fixes tens of smatch errors like the following:
> drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
> drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
> drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *

Could we beef up the changelog here a bit, please?

What _is_ the invalid casting?

What is the fix?

Why does it work?

Re: [PATCH 2/2] x86/uaccess: Fix casting in put_user

[Ricardo Ribalda]

Hi Dave

On Tue, 25 Aug 2026 at 23:06, Dave Hansen <dave.hansen@intel.com> wrote:
>
> On 8/25/26 13:02, Ricardo Ribalda wrote:
> > Recent versions of smatch preserved the address space qualifiers with
> > typeof()[1].
> >
> > This fix has discovered an invalid casting in put_user.
> >
> > This patch fixes tens of smatch errors like the following:
> > drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
> > drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
> > drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *
>
> Could we beef up the changelog here a bit, please?
>
> What _is_ the invalid casting?
>
> What is the fix?
>
> Why does it work?

Something like this would be better? I will send a v2 if there are no
more comments.


Recent versions of smatch preserved the address space qualifiers with
typeof()[1].

This fix has discovered an invalid casting in put_user.

put_user is using a casting with __typeof__(*(ptr)), which keeps the
qualifiers (__user), instead it should use the macro TYPEOF_UNQUAL()
that will use __typeof_unqual__ where the compiler supports it.
__typeof_unqual__ copies the type but not the qualifiers.


This patch fixes tens of smatch errors like the following:
drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in
argument 2 (different address spaces)
drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *

[1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f


-- 
Ricardo Ribalda

Re: [PATCH 2/2] x86/uaccess: Fix casting in put_user

[Dave Hansen]

On 8/25/26 14:15, Ricardo Ribalda wrote:
> 
> put_user is using a casting with __typeof__(*(ptr)), which keeps the
> qualifiers (__user), instead it should use the macro TYPEOF_UNQUAL()
> that will use __typeof_unqual__ where the compiler supports it.
> __typeof_unqual__ copies the type but not the qualifiers.

Oh, that's funny. I was assuming it was the 'const' causing the problem.
But I guess it makes sense that sparse would uniquely care about __user.

So the problem is that it tries to create a __user *integer*, which
makes no sense? Seems like we could just say that, too.

Re: [PATCH 2/2] x86/uaccess: Fix casting in put_user

[David Laight]

On Tue, 25 Aug 2026 23:15:02 +0200
Ricardo Ribalda <ribalda@chromium.org> wrote:

> Hi Dave
> 
> On Tue, 25 Aug 2026 at 23:06, Dave Hansen <dave.hansen@intel.com> wrote:
> >
> > On 8/25/26 13:02, Ricardo Ribalda wrote:  
> > > Recent versions of smatch preserved the address space qualifiers with
> > > typeof()[1].
> > >
> > > This fix has discovered an invalid casting in put_user.
> > >
> > > This patch fixes tens of smatch errors like the following:
> > > drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
> > > drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
> > > drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *  
> >
> > Could we beef up the changelog here a bit, please?
> >
> > What _is_ the invalid casting?
> >
> > What is the fix?
> >
> > Why does it work?  
> 
> Something like this would be better? I will send a v2 if there are no
> more comments.
> 
> 
> Recent versions of smatch preserved the address space qualifiers with
> typeof()[1].
> 
> This fix has discovered an invalid casting in put_user.
> 
> put_user is using a casting with __typeof__(*(ptr)), which keeps the
> qualifiers (__user), instead it should use the macro TYPEOF_UNQUAL()
> that will use __typeof_unqual__ where the compiler supports it.
> __typeof_unqual__ copies the type but not the qualifiers.

This is a spares 'bug'.
You need to fix it without changing normal compiles.

There are enough put_user() calls that is will slow down compiles.

David

> 
> 
> This patch fixes tens of smatch errors like the following:
> drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in
> argument 2 (different address spaces)
> drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
> drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *
> 
> [1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f
> 
> 

Re: [PATCH 2/2] x86/uaccess: Fix casting in put_user

[Ricardo Ribalda]

Hi David

On Wed, 26 Aug 2026 at 11:58, David Laight <david.laight.linux@gmail.com> wrote:
>
> On Tue, 25 Aug 2026 23:15:02 +0200
> Ricardo Ribalda <ribalda@chromium.org> wrote:
>
> > Hi Dave
> >
> > On Tue, 25 Aug 2026 at 23:06, Dave Hansen <dave.hansen@intel.com> wrote:
> > >
> > > On 8/25/26 13:02, Ricardo Ribalda wrote:
> > > > Recent versions of smatch preserved the address space qualifiers with
> > > > typeof()[1].
> > > >
> > > > This fix has discovered an invalid casting in put_user.
> > > >
> > > > This patch fixes tens of smatch errors like the following:
> > > > drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
> > > > drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
> > > > drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *
> > >
> > > Could we beef up the changelog here a bit, please?
> > >
> > > What _is_ the invalid casting?
> > >
> > > What is the fix?
> > >
> > > Why does it work?
> >
> > Something like this would be better? I will send a v2 if there are no
> > more comments.
> >
> >
> > Recent versions of smatch preserved the address space qualifiers with
> > typeof()[1].
> >
> > This fix has discovered an invalid casting in put_user.
> >
> > put_user is using a casting with __typeof__(*(ptr)), which keeps the
> > qualifiers (__user), instead it should use the macro TYPEOF_UNQUAL()
> > that will use __typeof_unqual__ where the compiler supports it.
> > __typeof_unqual__ copies the type but not the qualifiers.
>
> This is a spares 'bug'.
> You need to fix it without changing normal compiles.

It seems that Sparse is doing the right thing. From Dan [1]

```
The do_put_user_call() is doing this:

__typeof__(*(ptr)) __x = (x); /* eval x once */

And ptr is the __user pointer so Sparse is doing the correct thing.
We could change the __typeof__ to __typeof_unqual__
```

[1] https://lore.kernel.org/all/aS1RhxHtknHzZE3Z@stanley.mountain/

>
> There are enough put_user() calls that is will slow down compiles.

I tried a defconfig build with and without the patch to see the
impact. The build time is almost identical (the 0.6s difference in
mean time is within the standard deviation)

with the patch:
  Time (mean ± σ):     69.958 s ±  1.072 s    [User: 2601.772 s,
System: 386.266 s]
  Range (min … max):   69.028 s … 71.517 s    5 runs

without the patch:
  Time (mean ± σ):     69.326 s ±  0.718 s    [User: 2552.068 s,
System: 378.156 s]
  Range (min … max):   68.268 s … 70.055 s    5 runs

$ gcc --version
gcc (Debian 15.2.0-8) 15.2.0


(  Benchmark: git clean -fxd; make defconfig; make -j >/tmp/out )


>
> David
>
> >
> >
> > This patch fixes tens of smatch errors like the following:
> > drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in
> > argument 2 (different address spaces)
> > drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
> > drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *
> >
> > [1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f
> >
> >
>


-- 
Ricardo Ribalda