From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: [axboe:rw_iter 71/471] kernel/dma/debug.c:775 filter_write() warn: potential spectre issue 'buf' [w]
Date: Sun, 08 Mar 2026 13:15:36 +0800 [thread overview]
Message-ID: <202603081355.2PyKPc2I-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
TO: Jens Axboe <axboe@kernel.dk>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux.git rw_iter
head: 0a49759be1c3b29207758e467fdc1a90d0716d06
commit: db55ad0fd65c64db85d76db88cc2549d6aa1f98c [71/471] dma-debug: convert to read/write iterators
:::::: branch date: 2 days ago
:::::: commit date: 2 days ago
config: openrisc-randconfig-r071-20260307 (https://download.01.org/0day-ci/archive/20260308/202603081355.2PyKPc2I-lkp@intel.com/config)
compiler: or1k-linux-gcc (GCC) 15.2.0
smatch: v0.5.0-9004-gb810ac53
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202603081355.2PyKPc2I-lkp@intel.com/
smatch warnings:
kernel/dma/debug.c:775 filter_write() warn: potential spectre issue 'buf' [w]
vim +/buf +775 kernel/dma/debug.c
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 756
db55ad0fd65c64 kernel/dma/debug.c Jens Axboe 2024-04-08 757 static ssize_t filter_write(struct kiocb *iocb, struct iov_iter *from)
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 758 {
db55ad0fd65c64 kernel/dma/debug.c Jens Axboe 2024-04-08 759 size_t count = iov_iter_count(from);
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 760 char buf[NAME_MAX_LEN];
c17e2cf7376a20 lib/dma-debug.c Joerg Roedel 2009-06-08 761 unsigned long flags;
c17e2cf7376a20 lib/dma-debug.c Joerg Roedel 2009-06-08 762 size_t len;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 763 int i;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 764
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 765 /*
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 766 * We can't copy from userspace directly. Access to
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 767 * current_driver_name is protected with a write_lock with irqs
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 768 * disabled. Since copy_from_user can fault and may sleep we
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 769 * need to copy to temporary buffer first
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 770 */
e7ed70eedccc78 lib/dma-debug.c Joerg Roedel 2009-06-08 771 len = min(count, (size_t)(NAME_MAX_LEN - 1));
db55ad0fd65c64 kernel/dma/debug.c Jens Axboe 2024-04-08 772 if (!copy_from_iter_full(buf, len, from))
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 773 return -EFAULT;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 774
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 @775 buf[len] = 0;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 776
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 777 write_lock_irqsave(&driver_name_lock, flags);
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 778
31232509478556 lib/dma-debug.c Joerg Roedel 2009-06-08 779 /*
31232509478556 lib/dma-debug.c Joerg Roedel 2009-06-08 780 * Now handle the string we got from userspace very carefully.
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 781 * The rules are:
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 782 * - only use the first token we got
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 783 * - token delimiter is everything looking like a space
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 784 * character (' ', '\n', '\t' ...)
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 785 *
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 786 */
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 787 if (!isalnum(buf[0])) {
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 788 /*
31232509478556 lib/dma-debug.c Joerg Roedel 2009-06-08 789 * If the first character userspace gave us is not
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 790 * alphanumerical then assume the filter should be
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 791 * switched off.
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 792 */
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 793 if (current_driver_name[0])
f737b095c60c63 kernel/dma/debug.c Robin Murphy 2018-12-10 794 pr_info("switching off dma-debug driver filter\n");
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 795 current_driver_name[0] = 0;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 796 current_driver = NULL;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 797 goto out_unlock;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 798 }
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 799
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 800 /*
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 801 * Now parse out the first token and use it as the name for the
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 802 * driver to filter for.
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 803 */
39a37ce1cc5eef lib/dma-debug.c Dan Carpenter 2010-04-06 804 for (i = 0; i < NAME_MAX_LEN - 1; ++i) {
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 805 current_driver_name[i] = buf[i];
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 806 if (isspace(buf[i]) || buf[i] == ' ' || buf[i] == 0)
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 807 break;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 808 }
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 809 current_driver_name[i] = 0;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 810 current_driver = NULL;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 811
f737b095c60c63 kernel/dma/debug.c Robin Murphy 2018-12-10 812 pr_info("enable driver filter for driver [%s]\n",
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 813 current_driver_name);
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 814
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 815 out_unlock:
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 816 write_unlock_irqrestore(&driver_name_lock, flags);
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 817
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 818 return count;
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 819 }
8a6fc708b9bb48 lib/dma-debug.c Joerg Roedel 2009-05-22 820
:::::: The code at line 775 was first introduced by commit
:::::: 8a6fc708b9bb48a79a385bdc2be0959ee2ab788d dma-debug: add debugfs file for driver filter
:::::: TO: Joerg Roedel <joerg.roedel@amd.com>
:::::: CC: Joerg Roedel <joerg.roedel@amd.com>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-03-08 5:15 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-03-08 5:15 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2026-03-11 0:27 [axboe:rw_iter 71/471] kernel/dma/debug.c:775 filter_write() warn: potential spectre issue 'buf' [w] kernel test robot
2026-03-09 13:57 kernel test robot
2026-03-07 12:43 kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202603081355.2PyKPc2I-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox