| Message ID | 2163689da6544c289254b3c69848acc36db998f5.1637313047.git.christophe.leroy@csgroup.eu (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | w1: Misuse of get_user()/put_user() reported by sparse | expand |
| Context | Check | Description |
|---|---|---|
| snowpatch_ozlabs/github-powerpc_clang | success | Successfully ran 7 jobs. |
| snowpatch_ozlabs/github-powerpc_sparse | success | Successfully ran 4 jobs. |
| snowpatch_ozlabs/github-powerpc_kernel_qemu | success | Successfully ran 24 jobs. |
On Fri, Nov 19, 2021 at 10:15:09AM +0100, Christophe Leroy wrote: > sparse warnings: (new ones prefixed by >>) > >> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char [noderef] __user *_pu_addr @@ got char *buf @@ > drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: expected char [noderef] __user *_pu_addr > drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: got char *buf > >> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const [noderef] __user *_gu_addr @@ got char const *buf @@ > drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: expected char const [noderef] __user *_gu_addr > drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: got char const *buf > > The buffer buf is a failsafe buffer in kernel space, it's not user > memory hence doesn't deserve the use of get_user() or put_user(). > > Access 'buf' content directly. > > Reported-by: kernel test robot <lkp@intel.com> > Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/ > Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu> > --- > drivers/w1/slaves/w1_ds28e04.c | 10 ++-------- > 1 file changed, 2 insertions(+), 8 deletions(-) > > diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c > index e4f336111edc..d75bb16fb7a1 100644 > --- a/drivers/w1/slaves/w1_ds28e04.c > +++ b/drivers/w1/slaves/w1_ds28e04.c > @@ -339,10 +339,7 @@ static BIN_ATTR_RW(pio, 1); > static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr, > char *buf) > { > - if (put_user(w1_enable_crccheck + 0x30, buf)) > - return -EFAULT; > - > - return sizeof(w1_enable_crccheck); > + return sprintf(buf, "%d", w1_enable_crccheck); This should be sysfs_emit(), right? > } > > static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, > @@ -353,11 +350,8 @@ static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, > if (count != 1 || !buf) > return -EINVAL; > > - if (get_user(val, buf)) > - return -EFAULT; > - > /* convert to decimal */ > - val = val - 0x30; > + val = *buf - 0x30; Why not use a proper function that can parse a string and turn it into a number? thanks, greg k-h
Le 26/11/2021 à 17:00, Greg Kroah-Hartman a écrit : > On Fri, Nov 19, 2021 at 10:15:09AM +0100, Christophe Leroy wrote: >> sparse warnings: (new ones prefixed by >>) >>>> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char [noderef] __user *_pu_addr @@ got char *buf @@ >> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: expected char [noderef] __user *_pu_addr >> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: got char *buf >>>> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const [noderef] __user *_gu_addr @@ got char const *buf @@ >> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: expected char const [noderef] __user *_gu_addr >> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: got char const *buf >> >> The buffer buf is a failsafe buffer in kernel space, it's not user >> memory hence doesn't deserve the use of get_user() or put_user(). >> >> Access 'buf' content directly. >> >> Reported-by: kernel test robot <lkp@intel.com> >> Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/ >> Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu> >> --- >> drivers/w1/slaves/w1_ds28e04.c | 10 ++-------- >> 1 file changed, 2 insertions(+), 8 deletions(-) >> >> diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c >> index e4f336111edc..d75bb16fb7a1 100644 >> --- a/drivers/w1/slaves/w1_ds28e04.c >> +++ b/drivers/w1/slaves/w1_ds28e04.c >> @@ -339,10 +339,7 @@ static BIN_ATTR_RW(pio, 1); >> static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr, >> char *buf) >> { >> - if (put_user(w1_enable_crccheck + 0x30, buf)) >> - return -EFAULT; >> - >> - return sizeof(w1_enable_crccheck); >> + return sprintf(buf, "%d", w1_enable_crccheck); > > This should be sysfs_emit(), right? Ok > >> } >> >> static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, >> @@ -353,11 +350,8 @@ static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, >> if (count != 1 || !buf) >> return -EINVAL; >> >> - if (get_user(val, buf)) >> - return -EFAULT; >> - >> /* convert to decimal */ >> - val = val - 0x30; >> + val = *buf - 0x30; > > Why not use a proper function that can parse a string and turn it into a > number? I wanted to keep the change minimal. But I can also replace it with some scanf. But don't we have any generic function to read and store a bool after all ? Thanks Christophe
On Fri, Nov 26, 2021 at 05:10:46PM +0100, Christophe Leroy wrote: > > > Le 26/11/2021 à 17:00, Greg Kroah-Hartman a écrit : > > On Fri, Nov 19, 2021 at 10:15:09AM +0100, Christophe Leroy wrote: > > > sparse warnings: (new ones prefixed by >>) > > > > > drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char [noderef] __user *_pu_addr @@ got char *buf @@ > > > drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: expected char [noderef] __user *_pu_addr > > > drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: got char *buf > > > > > drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const [noderef] __user *_gu_addr @@ got char const *buf @@ > > > drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: expected char const [noderef] __user *_gu_addr > > > drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: got char const *buf > > > > > > The buffer buf is a failsafe buffer in kernel space, it's not user > > > memory hence doesn't deserve the use of get_user() or put_user(). > > > > > > Access 'buf' content directly. > > > > > > Reported-by: kernel test robot <lkp@intel.com> > > > Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/ > > > Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu> > > > --- > > > drivers/w1/slaves/w1_ds28e04.c | 10 ++-------- > > > 1 file changed, 2 insertions(+), 8 deletions(-) > > > > > > diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c > > > index e4f336111edc..d75bb16fb7a1 100644 > > > --- a/drivers/w1/slaves/w1_ds28e04.c > > > +++ b/drivers/w1/slaves/w1_ds28e04.c > > > @@ -339,10 +339,7 @@ static BIN_ATTR_RW(pio, 1); > > > static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr, > > > char *buf) > > > { > > > - if (put_user(w1_enable_crccheck + 0x30, buf)) > > > - return -EFAULT; > > > - > > > - return sizeof(w1_enable_crccheck); > > > + return sprintf(buf, "%d", w1_enable_crccheck); > > > > This should be sysfs_emit(), right? > > Ok > > > > > > } > > > static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, > > > @@ -353,11 +350,8 @@ static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, > > > if (count != 1 || !buf) > > > return -EINVAL; > > > - if (get_user(val, buf)) > > > - return -EFAULT; > > > - > > > /* convert to decimal */ > > > - val = val - 0x30; > > > + val = *buf - 0x30; > > > > Why not use a proper function that can parse a string and turn it into a > > number? > > I wanted to keep the change minimal. But I can also replace it with some > scanf. > > But don't we have any generic function to read and store a bool after all ? Yes we do, please use kstrtobool(). thanks, greg k-h
diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c index e4f336111edc..d75bb16fb7a1 100644 --- a/drivers/w1/slaves/w1_ds28e04.c +++ b/drivers/w1/slaves/w1_ds28e04.c @@ -339,10 +339,7 @@ static BIN_ATTR_RW(pio, 1); static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr, char *buf) { - if (put_user(w1_enable_crccheck + 0x30, buf)) - return -EFAULT; - - return sizeof(w1_enable_crccheck); + return sprintf(buf, "%d", w1_enable_crccheck); } static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, @@ -353,11 +350,8 @@ static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, if (count != 1 || !buf) return -EINVAL; - if (get_user(val, buf)) - return -EFAULT; - /* convert to decimal */ - val = val - 0x30; + val = *buf - 0x30; if (val != 0 && val != 1) return -EINVAL;