Re: [PATCH v2 2/2] x86/uaccess: Drop the address space qualifier from put_user()

[David Laight <david.laight.linux@gmail.com>]

On Thu, 24 Sep 2026 09:19:16 +0200
Ricardo Ribalda <ribalda@chromium.org> wrote:

> Hi David
> 
> On Wed, 23 Sept 2026 at 17:22, David Laight
> <david.laight.linux@gmail.com> wrote:
> >
> > On Wed, 23 Sep 2026 13:08:20 +0200
> > Ricardo Ribalda <ribalda@chromium.org> wrote:
> >  
> > > Friendly ping?
> > >
> > > On Mon, 14 Sept 2026 at 15:53, Ricardo Ribalda <ribalda@chromium.org> wrote:  
> > > >
> > > > __typeof__() preserves every qualifier, the address space included.
> > > >
> > > > When we do __typeof(*__user *int), we are declaring a __user integer,
> > > > which is pretty much meaningless. A value in a register or in the stack
> > > > does not live in the user address space.  
> >
> > Doesn't that mean it is a smatch bug - so should be fixed there.  
> 
> I don't think it is a Smatch bug: __typeof__() preserves all
> qualifiers including address spaces. Smatch is just enforcing that
> more strictly now.
> 
> I'd prefer that developers explicitly say when they are crossing the
> address space boundaries, and TYPEOF_UNQUAL() seems to be the right
> macro, which also Dan recommended.

It depends where you are removing it.
TYPEOF_UNQUAL() also removes const - which you don't want to remove.
It is also entirely horrid on older versions of gcc.

David

> 
> >
> > Somewhere in the middle of this there ought to checks that the value
> > is the correct type (eg pointer v integer) and that, for put_user(),
> > the destination pointer isn't const.
> > Using:
> >         auto __x = 0 ? *ptr : x;
> > can be more succinct than other versions - might not help here.
> >
> > David
> >  
> > > >
> > > > This annotation did not trigger any error until a recent version of
> > > > smatch[1] started caring. And as a result of that now we have tens of
> > > > warnings like:
> > > >
> > > >   drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
> > > >   drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
> > > >   drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *
> > > >
> > > > Instead of __typeof__() use TYPEOF_UNQUAL(). It maps to
> > > > __typeof_unqual__() in recent compilers, so the address space annotation
> > > > is gone.
> > > >
> > > > [1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f
> > > >
> > > > Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
> > > > Link: https://lore.kernel.org/r/20260825-unqual-v1-2-7024fb81b4f9@chromium.org
> > > > Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
> > > > ---
> > > >  arch/x86/include/asm/uaccess.h | 4 ++--
> > > >  1 file changed, 2 insertions(+), 2 deletions(-)
> > > >
> > > > diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
> > > > index 3a0dd3c2b233..4e576c0b9131 100644
> > > > --- a/arch/x86/include/asm/uaccess.h
> > > > +++ b/arch/x86/include/asm/uaccess.h
> > > > @@ -172,7 +172,7 @@ extern void __put_user_nocheck_8(void);
> > > >         int __ret_pu;                                                   \
> > > >         void __user *__ptr_pu;                                          \
> > > >         register __typeof__(*(ptr)) __val_pu asm("%"_ASM_AX);           \
> > > > -       __typeof__(*(ptr)) __x = (x); /* eval x once */                 \
> > > > +       TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */              \
> > > >         __typeof__(ptr) __ptr = (ptr); /* eval ptr once */              \
> > > >         __chk_user_ptr(__ptr);                                          \
> > > >         __ptr_pu = __ptr;                                               \
> > > > @@ -231,7 +231,7 @@ extern void __put_user_nocheck_8(void);
> > > >
> > > >  #define __put_user_size(x, ptr, size, label)                           \
> > > >  do {                                                                   \
> > > > -       __typeof__(*(ptr)) __x = (x); /* eval x once */                 \
> > > > +       TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */              \
> > > >         __typeof__(ptr) __ptr = (ptr); /* eval ptr once */              \
> > > >         __chk_user_ptr(__ptr);                                          \
> > > >         switch (size) {                                                 \
> > > >
> > > > --
> > > > 2.55.0.1007.g17ff1f9808-goog
> > > >  
> > >
> > >  
> >  
> 
>