tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: b5504db0db8375a77340b5bb54c17cfb75d3c754 commit: f4ac72026ae0042a02d0bad7a61679a356ff97d8 [1315/1315] scsi: mptfusion: Fix double fetch bug in ioctl config: arm64-randconfig-001-20241128 (https://download.01.org/0day-ci/archive/20241128/202411282322.GQOVQGdk-lkp@i...) compiler: aarch64-linux-gcc (GCC) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241128/202411282322.GQOVQGdk-lkp@i...) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411282322.GQOVQGdk-lkp@intel.com/ Note: it may well be a FALSE warning. FWIW you are at least aware of it now. http://gcc.gnu.org/wiki/Better_Uninitialized_Warnings All warnings (new ones prefixed by >>): from drivers/message/fusion/mptctl.c:58: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'mptctl_readtest' at drivers/message/fusion/mptctl.c:1482:6: include/linux/uaccess.h:112:17: warning: 'karg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ In file included from include/linux/compiler.h:251, from include/linux/export.h:45, from include/linux/linkage.h:7, from include/linux/kernel.h:7, from drivers/message/fusion/mptctl.c:48: include/linux/kasan-checks.h: In function 'mptctl_readtest': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/message/fusion/mptctl.c:1480:34: note: 'karg' declared here 1480 | struct mpt_ioctl_test karg; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'mptctl_eventquery' at drivers/message/fusion/mptctl.c:1534:6: include/linux/uaccess.h:112:17: warning: 'karg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'mptctl_eventquery': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/message/fusion/mptctl.c:1532:42: note: 'karg' declared here 1532 | struct mpt_ioctl_eventquery karg; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'mptctl_eventreport' at drivers/message/fusion/mptctl.c:1604:6: include/linux/uaccess.h:112:17: warning: 'karg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'mptctl_eventreport': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/message/fusion/mptctl.c:1601:42: note: 'karg' declared here 1601 | struct mpt_ioctl_eventreport karg; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'mptctl_gettargetinfo' at drivers/message/fusion/mptctl.c:1375:6: include/linux/uaccess.h:112:17: warning: 'karg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'mptctl_gettargetinfo': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/message/fusion/mptctl.c:1364:37: note: 'karg' declared here 1364 | struct mpt_ioctl_targetinfo karg; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'mptctl_replace_fw' at drivers/message/fusion/mptctl.c:1650:6: include/linux/uaccess.h:112:17: warning: 'karg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'mptctl_replace_fw': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/message/fusion/mptctl.c:1647:42: note: 'karg' declared here 1647 | struct mpt_ioctl_replace_fw karg; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'mptctl_hp_targetinfo' at drivers/message/fusion/mptctl.c:2570:6: include/linux/uaccess.h:112:17: warning: 'karg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'mptctl_hp_targetinfo': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/message/fusion/mptctl.c:2563:33: note: 'karg' declared here 2563 | hp_target_info_t karg; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'mptctl_hp_hostinfo' at drivers/message/fusion/mptctl.c:2349:6: include/linux/uaccess.h:112:17: warning: 'karg' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'mptctl_hp_hostinfo': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/message/fusion/mptctl.c:2330:33: note: 'karg' declared here 2330 | hp_host_info_t karg; | ^~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'compat_mptfwxfer_ioctl.constprop.isra' at drivers/message/fusion/mptctl.c:2723:6:

...

include/linux/uaccess.h:112:17: warning: 'kfw32' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'compat_mptfwxfer_ioctl.constprop.isra': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/message/fusion/mptctl.c:2715:30: note: 'kfw32' declared here 2715 | struct mpt_fw_xfer32 kfw32; | ^~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from 'compat_mpt_command.constprop.isra' at drivers/message/fusion/mptctl.c:2763:6: include/linux/uaccess.h:112:17: warning: 'karg32' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function 'compat_mpt_command.constprop.isra': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/message/fusion/mptctl.c:2755:36: note: 'karg32' declared here 2755 | struct mpt_ioctl_command32 karg32; | ^~~~~~ In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:144:7, inlined from '__mptctl_ioctl.isra' at drivers/message/fusion/mptctl.c:631:6: include/linux/uaccess.h:112:17: warning: 'khdr' may be used uninitialized [-Wmaybe-uninitialized] 112 | kasan_check_write(to, n); | ^~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kasan-checks.h: In function '__mptctl_ioctl.isra': include/linux/kasan-checks.h:7:6: note: by argument 1 of type 'const volatile void *' to 'kasan_check_write' declared here 7 | void kasan_check_write(const volatile void *p, unsigned int size); | ^~~~~~~~~~~~~~~~~ drivers/message/fusion/mptctl.c:624:34: note: 'khdr' declared here 624 | mpt_ioctl_header khdr; | ^~~~

vim +/kfw32 +112 include/linux/uaccess.h d597580d373774b Al Viro 2017-03-20 104 d597580d373774b Al Viro 2017-03-20 105 #ifdef INLINE_COPY_FROM_USER d597580d373774b Al Viro 2017-03-20 106 static inline unsigned long d597580d373774b Al Viro 2017-03-20 107 _copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774b Al Viro 2017-03-20 108 { d597580d373774b Al Viro 2017-03-20 109 unsigned long res = n; 9c5f6908de03a4f Al Viro 2017-06-29 110 might_fault(); 4983cb67a383a73 Linus Torvalds 2019-02-14 111 if (likely(access_ok(from, n))) { 9c5f6908de03a4f Al Viro 2017-06-29 @112 kasan_check_write(to, n); d597580d373774b Al Viro 2017-03-20 113 res = raw_copy_from_user(to, from, n); 9c5f6908de03a4f Al Viro 2017-06-29 114 } d597580d373774b Al Viro 2017-03-20 115 if (unlikely(res)) d597580d373774b Al Viro 2017-03-20 116 memset(to + (n - res), 0, res); d597580d373774b Al Viro 2017-03-20 117 return res; d597580d373774b Al Viro 2017-03-20 118 } d597580d373774b Al Viro 2017-03-20 119 #else d597580d373774b Al Viro 2017-03-20 120 extern unsigned long d597580d373774b Al Viro 2017-03-20 121 _copy_from_user(void *, const void __user *, unsigned long); d597580d373774b Al Viro 2017-03-20 122 #endif d597580d373774b Al Viro 2017-03-20 123 d597580d373774b Al Viro 2017-03-20 124 #ifdef INLINE_COPY_TO_USER d597580d373774b Al Viro 2017-03-20 125 static inline unsigned long d597580d373774b Al Viro 2017-03-20 126 _copy_to_user(void __user *to, const void *from, unsigned long n) d597580d373774b Al Viro 2017-03-20 127 { 9c5f6908de03a4f Al Viro 2017-06-29 128 might_fault(); 4983cb67a383a73 Linus Torvalds 2019-02-14 129 if (access_ok(to, n)) { 9c5f6908de03a4f Al Viro 2017-06-29 130 kasan_check_read(from, n); d597580d373774b Al Viro 2017-03-20 131 n = raw_copy_to_user(to, from, n); 9c5f6908de03a4f Al Viro 2017-06-29 132 } d597580d373774b Al Viro 2017-03-20 133 return n; d597580d373774b Al Viro 2017-03-20 134 } d597580d373774b Al Viro 2017-03-20 135 #else d597580d373774b Al Viro 2017-03-20 136 extern unsigned long d597580d373774b Al Viro 2017-03-20 137 _copy_to_user(void __user *, const void *, unsigned long); d597580d373774b Al Viro 2017-03-20 138 #endif d597580d373774b Al Viro 2017-03-20 139 d597580d373774b Al Viro 2017-03-20 140 static __always_inline unsigned long __must_check d597580d373774b Al Viro 2017-03-20 141 copy_from_user(void *to, const void __user *from, unsigned long n) d597580d373774b Al Viro 2017-03-20 142 { b0377fedb652808 Al Viro 2017-06-29 143 if (likely(check_copy_size(to, n, false))) d597580d373774b Al Viro 2017-03-20 @144 n = _copy_from_user(to, from, n); d597580d373774b Al Viro 2017-03-20 145 return n; d597580d373774b Al Viro 2017-03-20 146 } d597580d373774b Al Viro 2017-03-20 147 :::::: The code at line 112 was first introduced by commit :::::: 9c5f6908de03a4f52ba7364b11fcd6116225480c copy_{from,to}_user(): move kasan checks and might_fault() out-of-line :::::: TO: Al Viro <viro@zeniv.linux.org.uk> :::::: CC: Al Viro <viro@zeniv.linux.org.uk> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki