linux-kernel - lib/test_hmm.c:928 dmirror_fops_unlocked_ioctl() warn: comparison of a potentially tagged address (dmirror_fops_unlocked

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Sun, 14 Mar 2021 01:42:02 +0800
From:   kernel test robot <lkp@...el.com>
To:     Ralph Campbell <rcampbell@...dia.com>
Cc:     kbuild-all@...ts.01.org, linux-kernel@...r.kernel.org,
        Jason Gunthorpe <jgg@...lanox.com>,
        Jérôme Glisse <jglisse@...hat.com>,
        Wei Yongjun <weiyongjun1@...wei.com>,
        Dan Carpenter <error27@...il.com>
Subject: lib/test_hmm.c:928 dmirror_fops_unlocked_ioctl() warn: comparison of
 a potentially tagged address (dmirror_fops_unlocked_ioctl, -2, cmd.addr)

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   f296bfd5cd04cbb49b8fc9585adc280ab2b58624
commit: b2ef9f5a5cb37643ca5def3516c546457074b882 mm/hmm/test: add selftest driver for HMM
date:   10 months ago
config: arm64-randconfig-m031-20210312 (attached as .config)
compiler: aarch64-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@...el.com>

New smatch warnings:
lib/test_hmm.c:928 dmirror_fops_unlocked_ioctl() warn: comparison of a potentially tagged address (dmirror_fops_unlocked_ioctl, -2, cmd.addr)

Old smatch warnings:
lib/test_hmm.c:523 dmirror_allocate_chunk() error: we previously assumed 'devmem' could be null (see line 478)
lib/test_hmm.c:523 dmirror_allocate_chunk() error: dereferencing freed memory 'devmem'

vim +928 lib/test_hmm.c

   911	
   912	static long dmirror_fops_unlocked_ioctl(struct file *filp,
   913						unsigned int command,
   914						unsigned long arg)
   915	{
   916		void __user *uarg = (void __user *)arg;
   917		struct hmm_dmirror_cmd cmd;
   918		struct dmirror *dmirror;
   919		int ret;
   920	
   921		dmirror = filp->private_data;
   922		if (!dmirror)
   923			return -EINVAL;
   924	
   925		if (copy_from_user(&cmd, uarg, sizeof(cmd)))
   926			return -EFAULT;
   927	
 > 928		if (cmd.addr & ~PAGE_MASK)
   929			return -EINVAL;
   930		if (cmd.addr >= (cmd.addr + (cmd.npages << PAGE_SHIFT)))
   931			return -EINVAL;
   932	
   933		cmd.cpages = 0;
   934		cmd.faults = 0;
   935	
   936		switch (command) {
   937		case HMM_DMIRROR_READ:
   938			ret = dmirror_read(dmirror, &cmd);
   939			break;
   940	
   941		case HMM_DMIRROR_WRITE:
   942			ret = dmirror_write(dmirror, &cmd);
   943			break;
   944	
   945		case HMM_DMIRROR_MIGRATE:
   946			ret = dmirror_migrate(dmirror, &cmd);
   947			break;
   948	
   949		case HMM_DMIRROR_SNAPSHOT:
   950			ret = dmirror_snapshot(dmirror, &cmd);
   951			break;
   952	
   953		default:
   954			return -EINVAL;
   955		}
   956		if (ret)
   957			return ret;
   958	
   959		if (copy_to_user(uarg, &cmd, sizeof(cmd)))
   960			return -EFAULT;
   961	
   962		return 0;
   963	}
   964	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

Download attachment ".config.gz" of type "application/gzip" (29449 bytes)