linux-kernel - Re: [PATCH v2 1/3] futex: Use explicit sizes for compat_exit_robust

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <202411022242.XCJECOCz-lkp@intel.com>
Date: Sat, 2 Nov 2024 22:57:16 +0800
From: kernel test robot <lkp@...el.com>
To: André Almeida <andrealmeid@...lia.com>,
	Thomas Gleixner <tglx@...utronix.de>,
	Ingo Molnar <mingo@...hat.com>,
	Peter Zijlstra <peterz@...radead.org>,
	Darren Hart <dvhart@...radead.org>,
	Davidlohr Bueso <dave@...olabs.net>, Arnd Bergmann <arnd@...db.de>,
	sonicadvance1@...il.com
Cc: oe-kbuild-all@...ts.linux.dev, linux-kernel@...r.kernel.org,
	kernel-dev@...lia.com, linux-api@...r.kernel.org,
	Nathan Chancellor <nathan@...nel.org>,
	André Almeida <andrealmeid@...lia.com>
Subject: Re: [PATCH v2 1/3] futex: Use explicit sizes for
 compat_exit_robust_list

Hi André,

kernel test robot noticed the following build warnings:

[auto build test WARNING on tip/locking/core]
[also build test WARNING on tip/sched/core linus/master tip/x86/asm v6.12-rc5 next-20241101]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Andr-Almeida/futex-Use-explicit-sizes-for-compat_exit_robust_list/20241102-002419
base:   tip/locking/core
patch link:    https://lore.kernel.org/r/20241101162147.284993-2-andrealmeid%40igalia.com
patch subject: [PATCH v2 1/3] futex: Use explicit sizes for compat_exit_robust_list
config: x86_64-randconfig-123-20241102 (https://download.01.org/0day-ci/archive/20241102/202411022242.XCJECOCz-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241102/202411022242.XCJECOCz-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411022242.XCJECOCz-lkp@intel.com/

sparse warnings: (new ones prefixed by >>)
>> kernel/futex/core.c:914:59: sparse: sparse: cast removes address space '__user' of expression
>> kernel/futex/core.c:914:59: sparse: sparse: incorrect type in argument 3 (different address spaces) @@     expected unsigned int [noderef] [usertype] __user *head @@     got unsigned int [usertype] * @@
   kernel/futex/core.c:914:59: sparse:     expected unsigned int [noderef] [usertype] __user *head
   kernel/futex/core.c:914:59: sparse:     got unsigned int [usertype] *

vim +/__user +914 kernel/futex/core.c

   893	
   894	/*
   895	 * Walk curr->robust_list (very carefully, it's a userspace list!)
   896	 * and mark any locks found there dead, and notify any waiters.
   897	 *
   898	 * We silently return on any sign of list-walking problem.
   899	 */
   900	static void exit_robust_list32(struct task_struct *curr)
   901	{
   902		struct robust_list_head32 __user *head = curr->compat_robust_list;
   903		struct robust_list __user *entry, *next_entry, *pending;
   904		unsigned int limit = ROBUST_LIST_LIMIT, pi, pip;
   905		unsigned int next_pi;
   906		u32 uentry, next_uentry, upending;
   907		s32 futex_offset;
   908		int rc;
   909	
   910		/*
   911		 * Fetch the list head (which was registered earlier, via
   912		 * sys_set_robust_list()):
   913		 */
 > 914		if (fetch_robust_entry32((u32 *)&uentry, &entry, (u32 *)&head->list.next, &pi))
   915			return;
   916		/*
   917		 * Fetch the relative futex offset:
   918		 */
   919		if (get_user(futex_offset, &head->futex_offset))
   920			return;
   921		/*
   922		 * Fetch any possibly pending lock-add first, and handle it
   923		 * if it exists:
   924		 */
   925		if (fetch_robust_entry32(&upending, &pending,
   926				       &head->list_op_pending, &pip))
   927			return;
   928	
   929		next_entry = NULL;	/* avoid warning with gcc */
   930		while (entry != (struct robust_list __user *) &head->list) {
   931			/*
   932			 * Fetch the next entry in the list before calling
   933			 * handle_futex_death:
   934			 */
   935			rc = fetch_robust_entry32(&next_uentry, &next_entry,
   936				(u32 __user *)&entry->next, &next_pi);
   937			/*
   938			 * A pending lock might already be on the list, so
   939			 * dont process it twice:
   940			 */
   941			if (entry != pending) {
   942				void __user *uaddr = futex_uaddr(entry, futex_offset);
   943	
   944				if (handle_futex_death(uaddr, curr, pi,
   945						       HANDLE_DEATH_LIST))
   946					return;
   947			}
   948			if (rc)
   949				return;
   950			uentry = next_uentry;
   951			entry = next_entry;
   952			pi = next_pi;
   953			/*
   954			 * Avoid excessively long or circular lists:
   955			 */
   956			if (!--limit)
   957				break;
   958	
   959			cond_resched();
   960		}
   961		if (pending) {
   962			void __user *uaddr = futex_uaddr(pending, futex_offset);
   963	
   964			handle_futex_death(uaddr, curr, pip, HANDLE_DEATH_PENDING);
   965		}
   966	}
   967	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki