# \[PATCH\] w1: Misuse of get\_user()/put\_user() reported by sparse - Subsystems: THE REST, W1 DALLAS'S 1-WIRE BUS - Maintainers: Linus Torvalds, Krzysztof Kozlowski - List: linuxppc-dev - 4 messages, 2 authors - Page: https://ratatoskr.run/linuxppc-dev/2021/11/1579754/t ## \[PATCH\] w1: Misuse of get\_user()/put\_user() reported by sparse - From: Christophe Leroy \ - Date: 2021-11-19 09:15:47 - Message: https://ratatoskr.run/linuxppc-dev/2021/11/1579754.md ```text sparse warnings: (new ones prefixed by >>) >> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char [noderef] __user *_pu_addr @@ got char *buf @@ drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: expected char [noderef] __user *_pu_addr drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: got char *buf >> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const [noderef] __user *_gu_addr @@ got char const *buf @@ drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: expected char const [noderef] __user *_gu_addr drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: got char const *buf The buffer buf is a failsafe buffer in kernel space, it's not user memory hence doesn't deserve the use of get_user() or put_user(). Access 'buf' content directly. Reported-by: kernel test robot Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/ Signed-off-by: Christophe Leroy --- drivers/w1/slaves/w1_ds28e04.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c index e4f336111edc..d75bb16fb7a1 100644 --- a/drivers/w1/slaves/w1_ds28e04.c +++ b/drivers/w1/slaves/w1_ds28e04.c @@ -339,10 +339,7 @@ static BIN_ATTR_RW(pio, 1); static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr, char *buf) { - if (put_user(w1_enable_crccheck + 0x30, buf)) - return -EFAULT; - - return sizeof(w1_enable_crccheck); + return sprintf(buf, "%d", w1_enable_crccheck); } static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, @@ -353,11 +350,8 @@ static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, if (count != 1 || !buf) return -EINVAL; - if (get_user(val, buf)) - return -EFAULT; - /* convert to decimal */ - val = val - 0x30; + val = *buf - 0x30; if (val != 0 && val != 1) return -EINVAL; -- 2.33.1 ``` ## Re: \[PATCH\] w1: Misuse of get\_user()/put\_user() reported by sparse - From: Greg Kroah-Hartman \ - Date: 2021-11-26 16:10:39 - Message: https://ratatoskr.run/linuxppc-dev/2021/11/1587918.md ```text On Fri, Nov 19, 2021 at 10:15:09AM +0100, Christophe Leroy wrote: > sparse warnings: (new ones prefixed by >>) > >> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char [noderef] __user *_pu_addr @@ got char *buf @@ > drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: expected char [noderef] __user *_pu_addr > drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: got char *buf > >> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const [noderef] __user *_gu_addr @@ got char const *buf @@ > drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: expected char const [noderef] __user *_gu_addr > drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: got char const *buf > > The buffer buf is a failsafe buffer in kernel space, it's not user > memory hence doesn't deserve the use of get_user() or put_user(). > > Access 'buf' content directly. > > Reported-by: kernel test robot > Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/ > Signed-off-by: Christophe Leroy > --- > drivers/w1/slaves/w1_ds28e04.c | 10 ++-------- > 1 file changed, 2 insertions(+), 8 deletions(-) > > diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c > index e4f336111edc..d75bb16fb7a1 100644 > --- a/drivers/w1/slaves/w1_ds28e04.c > +++ b/drivers/w1/slaves/w1_ds28e04.c > @@ -339,10 +339,7 @@ static BIN_ATTR_RW(pio, 1); > static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr, > char *buf) > { > - if (put_user(w1_enable_crccheck + 0x30, buf)) > - return -EFAULT; > - > - return sizeof(w1_enable_crccheck); > + return sprintf(buf, "%d", w1_enable_crccheck); This should be sysfs_emit(), right? > } > > static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, > @@ -353,11 +350,8 @@ static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, > if (count != 1 || !buf) > return -EINVAL; > > - if (get_user(val, buf)) > - return -EFAULT; > - > /* convert to decimal */ > - val = val - 0x30; > + val = *buf - 0x30; Why not use a proper function that can parse a string and turn it into a number? thanks, greg k-h ``` ## Re: \[PATCH\] w1: Misuse of get\_user()/put\_user() reported by sparse - From: Christophe Leroy \ - Date: 2021-11-26 16:12:54 - Message: https://ratatoskr.run/linuxppc-dev/2021/11/1587921.md ```text Le 26/11/2021 à 17:00, Greg Kroah-Hartman a écrit : > On Fri, Nov 19, 2021 at 10:15:09AM +0100, Christophe Leroy wrote: >> sparse warnings: (new ones prefixed by >>) >>>> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char [noderef] __user *_pu_addr @@ got char *buf @@ >> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: expected char [noderef] __user *_pu_addr >> drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: got char *buf >>>> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const [noderef] __user *_gu_addr @@ got char const *buf @@ >> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: expected char const [noderef] __user *_gu_addr >> drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: got char const *buf >> >> The buffer buf is a failsafe buffer in kernel space, it's not user >> memory hence doesn't deserve the use of get_user() or put_user(). >> >> Access 'buf' content directly. >> >> Reported-by: kernel test robot >> Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/ >> Signed-off-by: Christophe Leroy >> --- >> drivers/w1/slaves/w1_ds28e04.c | 10 ++-------- >> 1 file changed, 2 insertions(+), 8 deletions(-) >> >> diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c >> index e4f336111edc..d75bb16fb7a1 100644 >> --- a/drivers/w1/slaves/w1_ds28e04.c >> +++ b/drivers/w1/slaves/w1_ds28e04.c >> @@ -339,10 +339,7 @@ static BIN_ATTR_RW(pio, 1); >> static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr, >> char *buf) >> { >> - if (put_user(w1_enable_crccheck + 0x30, buf)) >> - return -EFAULT; >> - >> - return sizeof(w1_enable_crccheck); >> + return sprintf(buf, "%d", w1_enable_crccheck); > > This should be sysfs_emit(), right? Ok > >> } >> >> static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, >> @@ -353,11 +350,8 @@ static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, >> if (count != 1 || !buf) >> return -EINVAL; >> >> - if (get_user(val, buf)) >> - return -EFAULT; >> - >> /* convert to decimal */ >> - val = val - 0x30; >> + val = *buf - 0x30; > > Why not use a proper function that can parse a string and turn it into a > number? I wanted to keep the change minimal. But I can also replace it with some scanf. But don't we have any generic function to read and store a bool after all ? Thanks Christophe ``` ## Re: \[PATCH\] w1: Misuse of get\_user()/put\_user() reported by sparse - From: Greg Kroah-Hartman \ - Date: 2021-11-26 16:26:15 - Message: https://ratatoskr.run/linuxppc-dev/2021/11/1587941.md ```text On Fri, Nov 26, 2021 at 05:10:46PM +0100, Christophe Leroy wrote: > > > Le 26/11/2021 à 17:00, Greg Kroah-Hartman a écrit : > > On Fri, Nov 19, 2021 at 10:15:09AM +0100, Christophe Leroy wrote: > > > sparse warnings: (new ones prefixed by >>) > > > > > drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char [noderef] __user *_pu_addr @@ got char *buf @@ > > > drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: expected char [noderef] __user *_pu_addr > > > drivers/w1/slaves/w1_ds28e04.c:342:13: sparse: got char *buf > > > > > drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: sparse: incorrect type in initializer (different address spaces) @@ expected char const [noderef] __user *_gu_addr @@ got char const *buf @@ > > > drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: expected char const [noderef] __user *_gu_addr > > > drivers/w1/slaves/w1_ds28e04.c:356:13: sparse: got char const *buf > > > > > > The buffer buf is a failsafe buffer in kernel space, it's not user > > > memory hence doesn't deserve the use of get_user() or put_user(). > > > > > > Access 'buf' content directly. > > > > > > Reported-by: kernel test robot > > > Link: https://lore.kernel.org/lkml/202111190526.K5vb7NWC-lkp@intel.com/T/ > > > Signed-off-by: Christophe Leroy > > > --- > > > drivers/w1/slaves/w1_ds28e04.c | 10 ++-------- > > > 1 file changed, 2 insertions(+), 8 deletions(-) > > > > > > diff --git a/drivers/w1/slaves/w1_ds28e04.c b/drivers/w1/slaves/w1_ds28e04.c > > > index e4f336111edc..d75bb16fb7a1 100644 > > > --- a/drivers/w1/slaves/w1_ds28e04.c > > > +++ b/drivers/w1/slaves/w1_ds28e04.c > > > @@ -339,10 +339,7 @@ static BIN_ATTR_RW(pio, 1); > > > static ssize_t crccheck_show(struct device *dev, struct device_attribute *attr, > > > char *buf) > > > { > > > - if (put_user(w1_enable_crccheck + 0x30, buf)) > > > - return -EFAULT; > > > - > > > - return sizeof(w1_enable_crccheck); > > > + return sprintf(buf, "%d", w1_enable_crccheck); > > > > This should be sysfs_emit(), right? > > Ok > > > > > > } > > > static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, > > > @@ -353,11 +350,8 @@ static ssize_t crccheck_store(struct device *dev, struct device_attribute *attr, > > > if (count != 1 || !buf) > > > return -EINVAL; > > > - if (get_user(val, buf)) > > > - return -EFAULT; > > > - > > > /* convert to decimal */ > > > - val = val - 0x30; > > > + val = *buf - 0x30; > > > > Why not use a proper function that can parse a string and turn it into a > > number? > > I wanted to keep the change minimal. But I can also replace it with some > scanf. > > But don't we have any generic function to read and store a bool after all ? Yes we do, please use kstrtobool(). thanks, greg k-h ```