Re: [bug report] io_uring: add support for fixed wait regions

[Jens Axboe <axboe@kernel.dk>]

On 10/30/24 5:40 AM, Dan Carpenter wrote:
> Hello Jens Axboe,
> 
> Commit 4b926ab18279 ("io_uring: add support for fixed wait regions")
> from Oct 22, 2024 (linux-next), leads to the following Smatch static
> checker warning:
> 
> 	io_uring/register.c:616 io_register_cqwait_reg()
> 	warn: was expecting a 64 bit value instead of '~(~(((1) << 12) - 1))'
> 
> io_uring/register.c
>     594 static int io_register_cqwait_reg(struct io_ring_ctx *ctx, void __user *uarg)
>     595 {
>     596         struct io_uring_cqwait_reg_arg arg;
>     597         struct io_uring_reg_wait *reg;
>     598         struct page **pages;
>     599         unsigned long len;
>     600         int nr_pages, poff;
>     601         int ret;
>     602 
>     603         if (ctx->cq_wait_page || ctx->cq_wait_arg)
>     604                 return -EBUSY;
>     605         if (copy_from_user(&arg, uarg, sizeof(arg)))
>     606                 return -EFAULT;
>     607         if (!arg.nr_entries || arg.flags)
>     608                 return -EINVAL;
>     609         if (arg.struct_size != sizeof(*reg))
>     610                 return -EINVAL;
>     611         if (check_mul_overflow(arg.struct_size, arg.nr_entries, &len))
>     612                 return -EOVERFLOW;
>     613         if (len > PAGE_SIZE)
>     614                 return -EINVAL;
>     615         /* offset + len must fit within a page, and must be reg_wait aligned */
> --> 616         poff = arg.user_addr & ~PAGE_MASK;
> 
> This is a harmless thing, but on 32 bit systems you can put whatever you want in
> the high 32 bits of arg.user_addr and it won't affect anything.

That is certainly true, it'll get masked away. I suspect this kind of
thing is everywhere, though? What do you suggest?

-- 
Jens Axboe