[PATCH v2 0/2] Fix warnings with recent smatch

[PATCH v2 0/2] Fix warnings with recent smatch

[Ricardo Ribalda]

Recent versions of smatch preserve the address space qualifiers while
running typeof() [1]. This has triggered tens of new sparse warnings in
media-ci.

This series takes care of them following Dan's suggestion [2].

[1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f
[2] https://lore.kernel.org/all/CANiDSCuizbMt77XfrzGPMa3Biai5TF1vcs+C5qdhYoLrP=9b3g@mail.gmail.com/

Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
Changes in v2:
- Add TYPEOF_NO_ADDRESS_SPACE() in compiler.h
- x86: improve changelog
- Link to v1: https://lore.kernel.org/r/20260825-unqual-v1-0-7024fb81b4f9@chromium.org

---
Ricardo Ribalda (2):
      rcu: Drop the address space qualifier from the dereference macros
      x86/uaccess: Drop the address space qualifier from put_user()

 arch/x86/include/asm/uaccess.h |  4 ++--
 include/linux/compiler.h       | 17 +++++++++++++++++
 include/linux/rcupdate.h       | 10 +++++-----
 3 files changed, 24 insertions(+), 7 deletions(-)
---
base-commit: 704340f1cd0dcef829eb62f5b48ae95a2ce17bdf
change-id: 20260825-unqual-25d9ee74fd10

Best regards,
-- 
Ricardo Ribalda <ribalda@chromium.org>

[PATCH v2 1/2] rcu: Drop the address space qualifier from the dereference macros

[Ricardo Ribalda]

The RCU dereference macros end with a cast that is meant to hand back a
plain kernel pointer from a __rcu pointer.

For that it uses:
	((typeof(*p) __force __kernel *)(local))

The problem is that typeof preserves every qualifier, including the
address space qualifiers (__rcu).

Recent versions of smatch[1] care about this and throw tens of warnings
like this one:
  ./include/trace/events/vb2.h:46:1: warning: incorrect type in assignment (different address spaces)
  ./include/trace/events/vb2.h:46:1:    expected struct tracepoint_func *it_func_ptr
  ./include/trace/events/vb2.h:46:1:    got struct tracepoint_func __rcu *

Use a new macro TYPEOF_NO_ADDRESS_SPACE() for the result type. This new
macro strips all the qualifiers when running with sparse (so const and
volatile are gone). But keeps all the qualifiers when running with the
compiler, caring about const/volatile mismatch.

[1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f

Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/20260825-unqual-v1-1-7024fb81b4f9@chromium.org
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
 include/linux/compiler.h | 17 +++++++++++++++++
 include/linux/rcupdate.h | 10 +++++-----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/include/linux/compiler.h b/include/linux/compiler.h
index cb2f6050bdf7..70cb31d60538 100644
--- a/include/linux/compiler.h
+++ b/include/linux/compiler.h
@@ -239,6 +239,23 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val,
 # define TYPEOF_UNQUAL(exp) __typeof__(exp)
 #endif
 
+/*
+ * TYPEOF_NO_ADDRESS_SPACE() - typeof() without the address space qualifiers
+ *
+ * No operator strips only the address space qualifiers: typeof() keeps every
+ * qualifier and TYPEOF_UNQUAL() drops every qualifier, const and volatile
+ * included.
+ *
+ * Approximate one by dropping the qualifiers for sparse only, as it is the
+ * only one that knows about address spaces. The compiler keeps seeing the fully
+ * qualified type, so a missing const or volatile will still throw a warning.
+ */
+#ifdef __CHECKER__
+# define TYPEOF_NO_ADDRESS_SPACE(exp) TYPEOF_UNQUAL(exp)
+#else
+# define TYPEOF_NO_ADDRESS_SPACE(exp) __typeof__(exp)
+#endif
+
 #endif /* __KERNEL__ */
 
 #if defined(CONFIG_CFI) && !defined(__DISABLE_EXPORTS) && !defined(BUILD_VDSO)
diff --git a/include/linux/rcupdate.h b/include/linux/rcupdate.h
index 44c07a66edff..3f74ae6d6e1f 100644
--- a/include/linux/rcupdate.h
+++ b/include/linux/rcupdate.h
@@ -488,7 +488,7 @@ static __always_inline bool lockdep_assert_rcu_helper(bool c, const struct __ctx
 context_unsafe(								\
 	typeof(*p) *local = (typeof(*p) *__force)(p);			\
 	rcu_check_sparse(p, __rcu);					\
-	((typeof(*p) __force __kernel *)(local))			\
+	((TYPEOF_NO_ADDRESS_SPACE(*p) __force __kernel *)(local))	\
 )
 /**
  * unrcu_pointer - mark a pointer as not being RCU protected
@@ -503,7 +503,7 @@ context_unsafe(								\
 ({ \
 	typeof(*p) *local = (typeof(*p) *__force)READ_ONCE(p); \
 	rcu_check_sparse(p, space); \
-	((typeof(*p) __force __kernel *)(local)); \
+	((TYPEOF_NO_ADDRESS_SPACE(*p) __force __kernel *)(local)); \
 }) )
 #define __rcu_dereference_check(p, local, c, space) \
 ({ \
@@ -511,19 +511,19 @@ context_unsafe(								\
 	typeof(*p) *local = (typeof(*p) *__force)READ_ONCE(p); \
 	RCU_LOCKDEP_WARN(!(c), "suspicious rcu_dereference_check() usage"); \
 	rcu_check_sparse(p, space); \
-	((typeof(*p) __force __kernel *)(local)); \
+	((TYPEOF_NO_ADDRESS_SPACE(*p) __force __kernel *)(local)); \
 })
 #define __rcu_dereference_protected(p, local, c, space) \
 ({ \
 	RCU_LOCKDEP_WARN(!(c), "suspicious rcu_dereference_protected() usage"); \
 	rcu_check_sparse(p, space); \
-	((typeof(*p) __force __kernel *)(p)); \
+	((TYPEOF_NO_ADDRESS_SPACE(*p) __force __kernel *)(p)); \
 })
 #define __rcu_dereference_raw(p, local) \
 ({ \
 	/* Dependency order vs. p above. */ \
 	typeof(p) local = READ_ONCE(p); \
-	((typeof(*p) __force __kernel *)(local)); \
+	((TYPEOF_NO_ADDRESS_SPACE(*p) __force __kernel *)(local)); \
 })
 #define rcu_dereference_raw(p) __rcu_dereference_raw(p, __UNIQUE_ID(rcu))
 

-- 
2.55.0.1007.g17ff1f9808-goog

[PATCH v2 2/2] x86/uaccess: Drop the address space qualifier from put_user()

[Ricardo Ribalda]

__typeof__() preserves every qualifier, the address space included.

When we do __typeof(*__user *int), we are declaring a __user integer,
which is pretty much meaningless. A value in a register or in the stack
does not live in the user address space.

This annotation did not trigger any error until a recent version of
smatch[1] started caring. And as a result of that now we have tens of
warnings like:

  drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
  drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
  drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *

Instead of __typeof__() use TYPEOF_UNQUAL(). It maps to
__typeof_unqual__() in recent compilers, so the address space annotation
is gone.

[1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f

Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/20260825-unqual-v1-2-7024fb81b4f9@chromium.org
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
---
 arch/x86/include/asm/uaccess.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 3a0dd3c2b233..4e576c0b9131 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -172,7 +172,7 @@ extern void __put_user_nocheck_8(void);
 	int __ret_pu;							\
 	void __user *__ptr_pu;						\
 	register __typeof__(*(ptr)) __val_pu asm("%"_ASM_AX);		\
-	__typeof__(*(ptr)) __x = (x); /* eval x once */			\
+	TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */		\
 	__typeof__(ptr) __ptr = (ptr); /* eval ptr once */		\
 	__chk_user_ptr(__ptr);						\
 	__ptr_pu = __ptr;						\
@@ -231,7 +231,7 @@ extern void __put_user_nocheck_8(void);
 
 #define __put_user_size(x, ptr, size, label)				\
 do {									\
-	__typeof__(*(ptr)) __x = (x); /* eval x once */			\
+	TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */		\
 	__typeof__(ptr) __ptr = (ptr); /* eval ptr once */		\
 	__chk_user_ptr(__ptr);						\
 	switch (size) {							\

-- 
2.55.0.1007.g17ff1f9808-goog

Re: [PATCH v2 2/2] x86/uaccess: Drop the address space qualifier from put_user()

[Paul E. McKenney]

On Mon, Sep 14, 2026 at 01:53:32PM +0000, Ricardo Ribalda wrote:
> __typeof__() preserves every qualifier, the address space included.
> 
> When we do __typeof(*__user *int), we are declaring a __user integer,
> which is pretty much meaningless. A value in a register or in the stack
> does not live in the user address space.
> 
> This annotation did not trigger any error until a recent version of
> smatch[1] started caring. And as a result of that now we have tens of
> warnings like:
> 
>   drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
>   drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
>   drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *
> 
> Instead of __typeof__() use TYPEOF_UNQUAL(). It maps to
> __typeof_unqual__() in recent compilers, so the address space annotation
> is gone.
> 
> [1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f
> 
> Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
> Link: https://lore.kernel.org/r/20260825-unqual-v1-2-7024fb81b4f9@chromium.org
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>

Queued for testing and review, thank you both!

							Thanx, Paul

> ---
>  arch/x86/include/asm/uaccess.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
> index 3a0dd3c2b233..4e576c0b9131 100644
> --- a/arch/x86/include/asm/uaccess.h
> +++ b/arch/x86/include/asm/uaccess.h
> @@ -172,7 +172,7 @@ extern void __put_user_nocheck_8(void);
>  	int __ret_pu;							\
>  	void __user *__ptr_pu;						\
>  	register __typeof__(*(ptr)) __val_pu asm("%"_ASM_AX);		\
> -	__typeof__(*(ptr)) __x = (x); /* eval x once */			\
> +	TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */		\
>  	__typeof__(ptr) __ptr = (ptr); /* eval ptr once */		\
>  	__chk_user_ptr(__ptr);						\
>  	__ptr_pu = __ptr;						\
> @@ -231,7 +231,7 @@ extern void __put_user_nocheck_8(void);
>  
>  #define __put_user_size(x, ptr, size, label)				\
>  do {									\
> -	__typeof__(*(ptr)) __x = (x); /* eval x once */			\
> +	TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */		\
>  	__typeof__(ptr) __ptr = (ptr); /* eval ptr once */		\
>  	__chk_user_ptr(__ptr);						\
>  	switch (size) {							\
> 
> -- 
> 2.55.0.1007.g17ff1f9808-goog
> 

Re: [PATCH v2 2/2] x86/uaccess: Drop the address space qualifier from put_user()

[Paul E. McKenney]

On Mon, Sep 14, 2026 at 07:58:23AM -0700, Paul E. McKenney wrote:
> On Mon, Sep 14, 2026 at 01:53:32PM +0000, Ricardo Ribalda wrote:
> > __typeof__() preserves every qualifier, the address space included.
> > 
> > When we do __typeof(*__user *int), we are declaring a __user integer,
> > which is pretty much meaningless. A value in a register or in the stack
> > does not live in the user address space.
> > 
> > This annotation did not trigger any error until a recent version of
> > smatch[1] started caring. And as a result of that now we have tens of
> > warnings like:
> > 
> >   drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
> >   drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
> >   drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *
> > 
> > Instead of __typeof__() use TYPEOF_UNQUAL(). It maps to
> > __typeof_unqual__() in recent compilers, so the address space annotation
> > is gone.
> > 
> > [1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f
> > 
> > Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
> > Link: https://lore.kernel.org/r/20260825-unqual-v1-2-7024fb81b4f9@chromium.org
> > Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> 
> Queued for testing and review, thank you both!

GAH!!!  I actually queued the rcu_ref one and replied to the wrong
email, apologies for my confusion.  Or was it a hallucination?
You be the judge!  ;-)

0a45e252da65 ("rcu: Drop the address space qualifier from the dereference macros")

							Thanx, Paul

> > ---
> >  arch/x86/include/asm/uaccess.h | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
> > index 3a0dd3c2b233..4e576c0b9131 100644
> > --- a/arch/x86/include/asm/uaccess.h
> > +++ b/arch/x86/include/asm/uaccess.h
> > @@ -172,7 +172,7 @@ extern void __put_user_nocheck_8(void);
> >  	int __ret_pu;							\
> >  	void __user *__ptr_pu;						\
> >  	register __typeof__(*(ptr)) __val_pu asm("%"_ASM_AX);		\
> > -	__typeof__(*(ptr)) __x = (x); /* eval x once */			\
> > +	TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */		\
> >  	__typeof__(ptr) __ptr = (ptr); /* eval ptr once */		\
> >  	__chk_user_ptr(__ptr);						\
> >  	__ptr_pu = __ptr;						\
> > @@ -231,7 +231,7 @@ extern void __put_user_nocheck_8(void);
> >  
> >  #define __put_user_size(x, ptr, size, label)				\
> >  do {									\
> > -	__typeof__(*(ptr)) __x = (x); /* eval x once */			\
> > +	TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */		\
> >  	__typeof__(ptr) __ptr = (ptr); /* eval ptr once */		\
> >  	__chk_user_ptr(__ptr);						\
> >  	switch (size) {							\
> > 
> > -- 
> > 2.55.0.1007.g17ff1f9808-goog
> > 
> 

Re: [PATCH v2 2/2] x86/uaccess: Drop the address space qualifier from put_user()

[Ricardo Ribalda]

Friendly ping?

On Mon, 14 Sept 2026 at 15:53, Ricardo Ribalda <ribalda@chromium.org> wrote:
>
> __typeof__() preserves every qualifier, the address space included.
>
> When we do __typeof(*__user *int), we are declaring a __user integer,
> which is pretty much meaningless. A value in a register or in the stack
> does not live in the user address space.
>
> This annotation did not trigger any error until a recent version of
> smatch[1] started caring. And as a result of that now we have tens of
> warnings like:
>
>   drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
>   drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
>   drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *
>
> Instead of __typeof__() use TYPEOF_UNQUAL(). It maps to
> __typeof_unqual__() in recent compilers, so the address space annotation
> is gone.
>
> [1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f
>
> Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
> Link: https://lore.kernel.org/r/20260825-unqual-v1-2-7024fb81b4f9@chromium.org
> Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> ---
>  arch/x86/include/asm/uaccess.h | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
> index 3a0dd3c2b233..4e576c0b9131 100644
> --- a/arch/x86/include/asm/uaccess.h
> +++ b/arch/x86/include/asm/uaccess.h
> @@ -172,7 +172,7 @@ extern void __put_user_nocheck_8(void);
>         int __ret_pu;                                                   \
>         void __user *__ptr_pu;                                          \
>         register __typeof__(*(ptr)) __val_pu asm("%"_ASM_AX);           \
> -       __typeof__(*(ptr)) __x = (x); /* eval x once */                 \
> +       TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */              \
>         __typeof__(ptr) __ptr = (ptr); /* eval ptr once */              \
>         __chk_user_ptr(__ptr);                                          \
>         __ptr_pu = __ptr;                                               \
> @@ -231,7 +231,7 @@ extern void __put_user_nocheck_8(void);
>
>  #define __put_user_size(x, ptr, size, label)                           \
>  do {                                                                   \
> -       __typeof__(*(ptr)) __x = (x); /* eval x once */                 \
> +       TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */              \
>         __typeof__(ptr) __ptr = (ptr); /* eval ptr once */              \
>         __chk_user_ptr(__ptr);                                          \
>         switch (size) {                                                 \
>
> --
> 2.55.0.1007.g17ff1f9808-goog
>


-- 
Ricardo Ribalda

Re: [PATCH v2 2/2] x86/uaccess: Drop the address space qualifier from put_user()

[David Laight]

On Wed, 23 Sep 2026 13:08:20 +0200
Ricardo Ribalda <ribalda@chromium.org> wrote:

> Friendly ping?
> 
> On Mon, 14 Sept 2026 at 15:53, Ricardo Ribalda <ribalda@chromium.org> wrote:
> >
> > __typeof__() preserves every qualifier, the address space included.
> >
> > When we do __typeof(*__user *int), we are declaring a __user integer,
> > which is pretty much meaningless. A value in a register or in the stack
> > does not live in the user address space.

Doesn't that mean it is a smatch bug - so should be fixed there.

Somewhere in the middle of this there ought to checks that the value
is the correct type (eg pointer v integer) and that, for put_user(),
the destination pointer isn't const.
Using:
	auto __x = 0 ? *ptr : x;
can be more succinct than other versions - might not help here.

David

> >
> > This annotation did not trigger any error until a recent version of
> > smatch[1] started caring. And as a result of that now we have tens of
> > warnings like:
> >
> >   drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
> >   drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
> >   drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *
> >
> > Instead of __typeof__() use TYPEOF_UNQUAL(). It maps to
> > __typeof_unqual__() in recent compilers, so the address space annotation
> > is gone.
> >
> > [1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f
> >
> > Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
> > Link: https://lore.kernel.org/r/20260825-unqual-v1-2-7024fb81b4f9@chromium.org
> > Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> > ---
> >  arch/x86/include/asm/uaccess.h | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
> > index 3a0dd3c2b233..4e576c0b9131 100644
> > --- a/arch/x86/include/asm/uaccess.h
> > +++ b/arch/x86/include/asm/uaccess.h
> > @@ -172,7 +172,7 @@ extern void __put_user_nocheck_8(void);
> >         int __ret_pu;                                                   \
> >         void __user *__ptr_pu;                                          \
> >         register __typeof__(*(ptr)) __val_pu asm("%"_ASM_AX);           \
> > -       __typeof__(*(ptr)) __x = (x); /* eval x once */                 \
> > +       TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */              \
> >         __typeof__(ptr) __ptr = (ptr); /* eval ptr once */              \
> >         __chk_user_ptr(__ptr);                                          \
> >         __ptr_pu = __ptr;                                               \
> > @@ -231,7 +231,7 @@ extern void __put_user_nocheck_8(void);
> >
> >  #define __put_user_size(x, ptr, size, label)                           \
> >  do {                                                                   \
> > -       __typeof__(*(ptr)) __x = (x); /* eval x once */                 \
> > +       TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */              \
> >         __typeof__(ptr) __ptr = (ptr); /* eval ptr once */              \
> >         __chk_user_ptr(__ptr);                                          \
> >         switch (size) {                                                 \
> >
> > --
> > 2.55.0.1007.g17ff1f9808-goog
> >  
> 
>