Re: [PATCH net-next 1/3] sock: add MSG_ZEROCOPY_UARG

[kernel test robot <lkp@intel.com>]

Hi,

kernel test robot noticed the following build warnings:

[auto build test WARNING on net-next/main]

url:    https://github.com/intel-lab-lkp/linux/commits/zijianzhang-bytedance-com/sock-add-MSG_ZEROCOPY_UARG/20240410-045616
base:   net-next/main
patch link:    https://lore.kernel.org/r/20240409205300.1346681-2-zijianzhang%40bytedance.com
patch subject: [PATCH net-next 1/3] sock: add MSG_ZEROCOPY_UARG
config: i386-randconfig-061-20240410 (https://download.01.org/0day-ci/archive/20240410/202404101954.FBZojOXG-lkp@intel.com/config)
compiler: gcc-13 (Ubuntu 13.2.0-4ubuntu3) 13.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240410/202404101954.FBZojOXG-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202404101954.FBZojOXG-lkp@intel.com/

sparse warnings: (new ones prefixed by >>)
>> net/core/sock.c:2878:37: sparse: sparse: incorrect type in argument 1 (different address spaces) @@     expected void [noderef] __user *to @@     got void * @@
   net/core/sock.c:2878:37: sparse:     expected void [noderef] __user *to
   net/core/sock.c:2878:37: sparse:     got void *
   net/core/sock.c:2393:9: sparse: sparse: context imbalance in 'sk_clone_lock' - wrong count at exit
   net/core/sock.c:2397:6: sparse: sparse: context imbalance in 'sk_free_unlock_clone' - unexpected unlock
   net/core/sock.c:4083:13: sparse: sparse: context imbalance in 'proto_seq_start' - wrong count at exit
   net/core/sock.c:4095:13: sparse: sparse: context imbalance in 'proto_seq_stop' - wrong count at exit

vim +2878 net/core/sock.c

  2807	
  2808	int __sock_cmsg_send(struct sock *sk, struct cmsghdr *cmsg,
  2809			     struct sockcm_cookie *sockc)
  2810	{
  2811		u32 tsflags;
  2812	
  2813		switch (cmsg->cmsg_type) {
  2814		case SO_MARK:
  2815			if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_RAW) &&
  2816			    !ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN))
  2817				return -EPERM;
  2818			if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32)))
  2819				return -EINVAL;
  2820			sockc->mark = *(u32 *)CMSG_DATA(cmsg);
  2821			break;
  2822		case SO_TIMESTAMPING_OLD:
  2823		case SO_TIMESTAMPING_NEW:
  2824			if (cmsg->cmsg_len != CMSG_LEN(sizeof(u32)))
  2825				return -EINVAL;
  2826	
  2827			tsflags = *(u32 *)CMSG_DATA(cmsg);
  2828			if (tsflags & ~SOF_TIMESTAMPING_TX_RECORD_MASK)
  2829				return -EINVAL;
  2830	
  2831			sockc->tsflags &= ~SOF_TIMESTAMPING_TX_RECORD_MASK;
  2832			sockc->tsflags |= tsflags;
  2833			break;
  2834		case SCM_TXTIME:
  2835			if (!sock_flag(sk, SOCK_TXTIME))
  2836				return -EINVAL;
  2837			if (cmsg->cmsg_len != CMSG_LEN(sizeof(u64)))
  2838				return -EINVAL;
  2839			sockc->transmit_time = get_unaligned((u64 *)CMSG_DATA(cmsg));
  2840			break;
  2841		/* SCM_RIGHTS and SCM_CREDENTIALS are semantically in SOL_UNIX. */
  2842		case SCM_RIGHTS:
  2843		case SCM_CREDENTIALS:
  2844			break;
  2845		case SO_ZEROCOPY_NOTIFICATION:
  2846			if (sock_flag(sk, SOCK_ZEROCOPY)) {
  2847				int i = 0;
  2848				struct tx_usr_zcopy_info sys_zcopy_info;
  2849				struct tx_msg_zcopy_node *zcopy_node_p, *tmp;
  2850				struct tx_msg_zcopy_queue *zcopy_queue;
  2851				struct tx_msg_zcopy_node *zcopy_node_ps[SOCK_USR_ZC_INFO_MAX];
  2852				unsigned long flags;
  2853	
  2854				if (cmsg->cmsg_len != CMSG_LEN(sizeof(void *)))
  2855					return -EINVAL;
  2856	
  2857				if (sk_is_tcp(sk))
  2858					zcopy_queue = &tcp_sk(sk)->tx_zcopy_queue;
  2859				else if (sk_is_udp(sk))
  2860					zcopy_queue = &udp_sk(sk)->tx_zcopy_queue;
  2861				else
  2862					return -EINVAL;
  2863	
  2864				spin_lock_irqsave(&zcopy_queue->lock, flags);
  2865				list_for_each_entry_safe(zcopy_node_p, tmp, &zcopy_queue->head, node) {
  2866					sys_zcopy_info.info[i].lo = zcopy_node_p->info.lo;
  2867					sys_zcopy_info.info[i].hi = zcopy_node_p->info.hi;
  2868					sys_zcopy_info.info[i].zerocopy = zcopy_node_p->info.zerocopy;
  2869					list_del(&zcopy_node_p->node);
  2870					zcopy_node_ps[i++] = zcopy_node_p;
  2871					if (i == SOCK_USR_ZC_INFO_MAX)
  2872						break;
  2873				}
  2874				spin_unlock_irqrestore(&zcopy_queue->lock, flags);
  2875	
  2876				if (i > 0) {
  2877					sys_zcopy_info.length = i;
> 2878					if (unlikely(copy_to_user(*(void **)CMSG_DATA(cmsg),
  2879								  &sys_zcopy_info,
  2880								  sizeof(sys_zcopy_info))
  2881						)) {
  2882						spin_lock_irqsave(&zcopy_queue->lock, flags);
  2883						while (i > 0)
  2884							list_add(&zcopy_node_ps[--i]->node,
  2885								 &zcopy_queue->head);
  2886						spin_unlock_irqrestore(&zcopy_queue->lock, flags);
  2887						return -EFAULT;
  2888					}
  2889	
  2890					while (i > 0)
  2891						consume_skb(zcopy_node_ps[--i]->skb);
  2892				}
  2893			}
  2894			break;
  2895		default:
  2896			return -EINVAL;
  2897		}
  2898		return 0;
  2899	}
  2900	EXPORT_SYMBOL(__sock_cmsg_send);
  2901	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki