| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202411011212.6RM81BEd-lkp@intel.com>
Date: Fri, 1 Nov 2024 12:56:34 +0800
From: kernel test robot <lkp@...el.com>
To: Ilya Leoshkevich <iii@...ux.ibm.com>
Cc: oe-kbuild-all@...ts.linux.dev, linux-kernel@...r.kernel.org,
Andrew Morton <akpm@...ux-foundation.org>,
Linux Memory Management List <linux-mm@...ck.org>,
Alexander Potapenko <glider@...gle.com>
Subject: mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space
'__user' of expression
Hi Ilya,
First bad commit (maybe != root cause):
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 6c52d4da1c742cd01a797a4d0a2d3c5a60dc9bfe
commit: 3a8f6f3b469b4075919a3613e182f9a70df92d46 kmsan: enable on s390
date: 4 months ago
config: s390-randconfig-r112-20241030 (https://download.01.org/0day-ci/archive/20241101/202411011212.6RM81BEd-lkp@intel.com/config)
compiler: clang version 20.0.0git (https://github.com/llvm/llvm-project 639a7ac648f1e50ccd2556e17d401c04f9cce625)
reproduce: (https://download.01.org/0day-ci/archive/20241101/202411011212.6RM81BEd-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411011212.6RM81BEd-lkp@intel.com/
sparse warnings: (new ones prefixed by >>)
>> mm/kmsan/hooks.c:269:14: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:271:75: sparse: sparse: incorrect type in argument 3 (different address spaces) @@ expected void const *user_addr @@ got void [noderef] __user *to @@
mm/kmsan/hooks.c:271:75: sparse: expected void const *user_addr
mm/kmsan/hooks.c:271:75: sparse: got void [noderef] __user *to
mm/kmsan/hooks.c:280:50: sparse: sparse: cast removes address space '__user' of expression
mm/kmsan/hooks.c:306:59: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:319:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:325:79: sparse: sparse: Using plain integer as NULL pointer
mm/kmsan/hooks.c:421:78: sparse: sparse: Using plain integer as NULL pointer
vim +/__user +269 mm/kmsan/hooks.c
b073d7f8aee4ebf Alexander Potapenko 2022-09-15 247
75cf0290271bf6d Alexander Potapenko 2022-09-15 248 void kmsan_copy_to_user(void __user *to, const void *from, size_t to_copy,
75cf0290271bf6d Alexander Potapenko 2022-09-15 249 size_t left)
75cf0290271bf6d Alexander Potapenko 2022-09-15 250 {
75cf0290271bf6d Alexander Potapenko 2022-09-15 251 unsigned long ua_flags;
75cf0290271bf6d Alexander Potapenko 2022-09-15 252
75cf0290271bf6d Alexander Potapenko 2022-09-15 253 if (!kmsan_enabled || kmsan_in_runtime())
75cf0290271bf6d Alexander Potapenko 2022-09-15 254 return;
75cf0290271bf6d Alexander Potapenko 2022-09-15 255 /*
75cf0290271bf6d Alexander Potapenko 2022-09-15 256 * At this point we've copied the memory already. It's hard to check it
75cf0290271bf6d Alexander Potapenko 2022-09-15 257 * before copying, as the size of actually copied buffer is unknown.
75cf0290271bf6d Alexander Potapenko 2022-09-15 258 */
75cf0290271bf6d Alexander Potapenko 2022-09-15 259
75cf0290271bf6d Alexander Potapenko 2022-09-15 260 /* copy_to_user() may copy zero bytes. No need to check. */
75cf0290271bf6d Alexander Potapenko 2022-09-15 261 if (!to_copy)
75cf0290271bf6d Alexander Potapenko 2022-09-15 262 return;
75cf0290271bf6d Alexander Potapenko 2022-09-15 263 /* Or maybe copy_to_user() failed to copy anything. */
75cf0290271bf6d Alexander Potapenko 2022-09-15 264 if (to_copy <= left)
75cf0290271bf6d Alexander Potapenko 2022-09-15 265 return;
75cf0290271bf6d Alexander Potapenko 2022-09-15 266
75cf0290271bf6d Alexander Potapenko 2022-09-15 267 ua_flags = user_access_save();
f926e9326f3a79f Ilya Leoshkevich 2024-06-21 268 if (!IS_ENABLED(CONFIG_ARCH_HAS_NON_OVERLAPPING_ADDRESS_SPACE) ||
f926e9326f3a79f Ilya Leoshkevich 2024-06-21 @269 (u64)to < TASK_SIZE) {
75cf0290271bf6d Alexander Potapenko 2022-09-15 270 /* This is a user memory access, check it. */
75cf0290271bf6d Alexander Potapenko 2022-09-15 271 kmsan_internal_check_memory((void *)from, to_copy - left, to,
75cf0290271bf6d Alexander Potapenko 2022-09-15 272 REASON_COPY_TO_USER);
75cf0290271bf6d Alexander Potapenko 2022-09-15 273 } else {
75cf0290271bf6d Alexander Potapenko 2022-09-15 274 /* Otherwise this is a kernel memory access. This happens when a
75cf0290271bf6d Alexander Potapenko 2022-09-15 275 * compat syscall passes an argument allocated on the kernel
75cf0290271bf6d Alexander Potapenko 2022-09-15 276 * stack to a real syscall.
75cf0290271bf6d Alexander Potapenko 2022-09-15 277 * Don't check anything, just copy the shadow of the copied
75cf0290271bf6d Alexander Potapenko 2022-09-15 278 * bytes.
75cf0290271bf6d Alexander Potapenko 2022-09-15 279 */
75cf0290271bf6d Alexander Potapenko 2022-09-15 280 kmsan_internal_memmove_metadata((void *)to, (void *)from,
75cf0290271bf6d Alexander Potapenko 2022-09-15 281 to_copy - left);
75cf0290271bf6d Alexander Potapenko 2022-09-15 282 }
75cf0290271bf6d Alexander Potapenko 2022-09-15 283 user_access_restore(ua_flags);
75cf0290271bf6d Alexander Potapenko 2022-09-15 284 }
75cf0290271bf6d Alexander Potapenko 2022-09-15 285 EXPORT_SYMBOL(kmsan_copy_to_user);
75cf0290271bf6d Alexander Potapenko 2022-09-15 286
:::::: The code at line 269 was first introduced by commit
:::::: f926e9326f3a79f7e01ac790e2361f44d8ca8320 kmsan: fix kmsan_copy_to_user() on arches with overlapping address spaces
:::::: TO: Ilya Leoshkevich <iii@...ux.ibm.com>
:::::: CC: Andrew Morton <akpm@...ux-foundation.org>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists