tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: ef2982312942ba96fb8217df5d832051bae4afd2 commit: ca67230a79f23abbf552a5cb3471d46ff8b672c8 [5766/21589] x86/uaccess: Dont leak the AC flag into __put_user() argument evaluation :::::: branch date: 12 hours ago :::::: commit date: 4 years, 1 month ago config: x86_64-randconfig-121-20240125 (attached as .config) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (attached as reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot lkp@intel.com | Closes: https://lore.kernel.org/oe-kbuild-all/202401300305.gYla1O9J-lkp@intel.com/

sparse warnings: (new ones prefixed by >>) arch/x86/kernel/fpu/signal.c:94:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:94:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:94:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:94:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:94:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:94:16: sparse: sparse: cast removes address space '__user' of expression

...

arch/x86/kernel/fpu/signal.c:94:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __user *ptr @@ got unsigned int [usertype] *__pu_ptr @@

arch/x86/kernel/fpu/signal.c:94:16: sparse: expected void const volatile [noderef] __user *ptr arch/x86/kernel/fpu/signal.c:94:16: sparse: got unsigned int [usertype] *__pu_ptr arch/x86/kernel/fpu/signal.c:101:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:101:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:101:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __user *ptr @@ got unsigned int [usertype] * @@ arch/x86/kernel/fpu/signal.c:101:16: sparse: expected void const volatile [noderef] __user *ptr arch/x86/kernel/fpu/signal.c:101:16: sparse: got unsigned int [usertype] * arch/x86/kernel/fpu/signal.c:101:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:101:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:101:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:101:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:101:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:101:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:116:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:116:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:116:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:116:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:116:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:116:16: sparse: sparse: cast removes address space '__user' of expression arch/x86/kernel/fpu/signal.c:116:16: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const volatile [noderef] __user *ptr @@ got unsigned int [usertype] *__pu_ptr @@ arch/x86/kernel/fpu/signal.c:116:16: sparse: expected void const volatile [noderef] __user *ptr arch/x86/kernel/fpu/signal.c:116:16: sparse: got unsigned int [usertype] *__pu_ptr

vim +94 arch/x86/kernel/fpu/signal.c

b992c660d3b316 Ingo Molnar 2015-04-30 79 b992c660d3b316 Ingo Molnar 2015-04-30 80 static inline int save_xstate_epilog(void __user *buf, int ia32_frame) b992c660d3b316 Ingo Molnar 2015-04-30 81 { c47ada305de380 Ingo Molnar 2015-04-30 82 struct xregs_state __user *x = buf; b992c660d3b316 Ingo Molnar 2015-04-30 83 struct _fpx_sw_bytes *sw_bytes; b992c660d3b316 Ingo Molnar 2015-04-30 84 u32 xfeatures; b992c660d3b316 Ingo Molnar 2015-04-30 85 int err; b992c660d3b316 Ingo Molnar 2015-04-30 86 b992c660d3b316 Ingo Molnar 2015-04-30 87 /* Setup the bytes not touched by the [f]xsave and reserved for SW. */ b992c660d3b316 Ingo Molnar 2015-04-30 88 sw_bytes = ia32_frame ? &fx_sw_reserved_ia32 : &fx_sw_reserved; b992c660d3b316 Ingo Molnar 2015-04-30 89 err = __copy_to_user(&x->i387.sw_reserved, sw_bytes, sizeof(*sw_bytes)); b992c660d3b316 Ingo Molnar 2015-04-30 90 b992c660d3b316 Ingo Molnar 2015-04-30 91 if (!use_xsave()) b992c660d3b316 Ingo Molnar 2015-04-30 92 return err; b992c660d3b316 Ingo Molnar 2015-04-30 93 a1141e0b5ca6ee Fenghua Yu 2016-05-20 @94 err |= __put_user(FP_XSTATE_MAGIC2, a1141e0b5ca6ee Fenghua Yu 2016-05-20 95 (__u32 *)(buf + fpu_user_xstate_size)); b992c660d3b316 Ingo Molnar 2015-04-30 96 b992c660d3b316 Ingo Molnar 2015-04-30 97 /* b992c660d3b316 Ingo Molnar 2015-04-30 98 * Read the xfeatures which we copied (directly from the cpu or b992c660d3b316 Ingo Molnar 2015-04-30 99 * from the state in task struct) to the user buffers. b992c660d3b316 Ingo Molnar 2015-04-30 100 */ b992c660d3b316 Ingo Molnar 2015-04-30 101 err |= __get_user(xfeatures, (__u32 *)&x->header.xfeatures); b992c660d3b316 Ingo Molnar 2015-04-30 102 b992c660d3b316 Ingo Molnar 2015-04-30 103 /* b992c660d3b316 Ingo Molnar 2015-04-30 104 * For legacy compatible, we always set FP/SSE bits in the bit b992c660d3b316 Ingo Molnar 2015-04-30 105 * vector while saving the state to the user context. This will b992c660d3b316 Ingo Molnar 2015-04-30 106 * enable us capturing any changes(during sigreturn) to b992c660d3b316 Ingo Molnar 2015-04-30 107 * the FP/SSE bits by the legacy applications which don't touch b992c660d3b316 Ingo Molnar 2015-04-30 108 * xfeatures in the xsave header. b992c660d3b316 Ingo Molnar 2015-04-30 109 * b992c660d3b316 Ingo Molnar 2015-04-30 110 * xsave aware apps can change the xfeatures in the xsave b992c660d3b316 Ingo Molnar 2015-04-30 111 * header as well as change any contents in the memory layout. b992c660d3b316 Ingo Molnar 2015-04-30 112 * xrestore as part of sigreturn will capture all the changes. b992c660d3b316 Ingo Molnar 2015-04-30 113 */ d91cab78133d33 Dave Hansen 2015-09-02 114 xfeatures |= XFEATURE_MASK_FPSSE; b992c660d3b316 Ingo Molnar 2015-04-30 115 b992c660d3b316 Ingo Molnar 2015-04-30 116 err |= __put_user(xfeatures, (__u32 *)&x->header.xfeatures); b992c660d3b316 Ingo Molnar 2015-04-30 117 b992c660d3b316 Ingo Molnar 2015-04-30 118 return err; b992c660d3b316 Ingo Molnar 2015-04-30 119 } b992c660d3b316 Ingo Molnar 2015-04-30 120

:::::: The code at line 94 was first introduced by commit :::::: a1141e0b5ca6ee3e5e35d5f1a310a5ecb9c96ce5 x86/fpu/xstate: Define and use 'fpu_user_xstate_size'

:::::: TO: Fenghua Yu fenghua.yu@intel.com :::::: CC: Ingo Molnar mingo@kernel.org