arch/powerpc/platforms/pseries/papr-hvpipe.c:214 hvpipe_rtas_recv_msg() warn: maybe return -EFAULT instead of the bytes remaining?
From: Dan Carpenter
Date: Mon Apr 13 2026 - 03:49:23 EST
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: f5459048c38a00fc583658d6dcd0f894aff6df8f
commit: cebdb522fd3edd1fe05f7b4a74a27da7dd0f8d86 powerpc/pseries: Receive payload with ibm,receive-hvpipe-msg RTAS
config: powerpc64-randconfig-r071-20260412 (https://download.01.org/0day-ci/archive/20260412/202604121903.MkgWjl8q-lkp@xxxxxxxxx/config)
compiler: powerpc64-linux-gcc (GCC) 13.4.0
smatch: v0.5.0-9004-gb810ac53
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: cebdb522fd3e ("powerpc/pseries: Receive payload with ibm,receive-hvpipe-msg RTAS")
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Reported-by: Dan Carpenter <error27@xxxxxxxxx>
| Closes: https://lore.kernel.org/r/202604121903.MkgWjl8q-lkp@xxxxxxxxx/
New smatch warnings:
arch/powerpc/platforms/pseries/papr-hvpipe.c:214 hvpipe_rtas_recv_msg() warn: maybe return -EFAULT instead of the bytes remaining?
Old smatch warnings:
arch/powerpc/platforms/pseries/papr-hvpipe.c:360 papr_hvpipe_handle_read() warn: maybe return -EFAULT instead of the bytes remaining?
vim +214 arch/powerpc/platforms/pseries/papr-hvpipe.c
cebdb522fd3edd Haren Myneni 2025-09-09 174 static int hvpipe_rtas_recv_msg(char __user *buf, int size)
cebdb522fd3edd Haren Myneni 2025-09-09 175 {
cebdb522fd3edd Haren Myneni 2025-09-09 176 struct rtas_work_area *work_area;
cebdb522fd3edd Haren Myneni 2025-09-09 177 u32 srcID, bytes_written;
cebdb522fd3edd Haren Myneni 2025-09-09 178 int ret;
cebdb522fd3edd Haren Myneni 2025-09-09 179
cebdb522fd3edd Haren Myneni 2025-09-09 180 work_area = rtas_work_area_alloc(SZ_4K);
cebdb522fd3edd Haren Myneni 2025-09-09 181 if (!work_area) {
cebdb522fd3edd Haren Myneni 2025-09-09 182 pr_err("Could not allocate RTAS buffer for recv pipe\n");
cebdb522fd3edd Haren Myneni 2025-09-09 183 return -ENOMEM;
cebdb522fd3edd Haren Myneni 2025-09-09 184 }
cebdb522fd3edd Haren Myneni 2025-09-09 185
cebdb522fd3edd Haren Myneni 2025-09-09 186 ret = rtas_ibm_receive_hvpipe_msg(work_area, &srcID,
cebdb522fd3edd Haren Myneni 2025-09-09 187 &bytes_written);
cebdb522fd3edd Haren Myneni 2025-09-09 188 if (!ret) {
Flip this around. Always do error handling, not success handling.
Otherwise imagine if we have 9 successful calls in a row, that would be
10 tabs so we would be beyond the end of the 80 character limit.
if (ret) {
pr_err("ibm,receive-hvpipe-msg failed with %d\n", ret);
goto free_work_area;
}
cebdb522fd3edd Haren Myneni 2025-09-09 189 /*
cebdb522fd3edd Haren Myneni 2025-09-09 190 * Recv HVPIPE RTAS is successful.
cebdb522fd3edd Haren Myneni 2025-09-09 191 * When releasing FD or no one is waiting on the
cebdb522fd3edd Haren Myneni 2025-09-09 192 * specific source, issue recv HVPIPE RTAS call
cebdb522fd3edd Haren Myneni 2025-09-09 193 * so that pipe is not blocked - this func is called
cebdb522fd3edd Haren Myneni 2025-09-09 194 * with NULL buf.
cebdb522fd3edd Haren Myneni 2025-09-09 195 */
cebdb522fd3edd Haren Myneni 2025-09-09 196 if (buf) {
if (!buf) {
/* blah blah blah explanation */
ret = 0;
goto free_work_area;
}
cebdb522fd3edd Haren Myneni 2025-09-09 197 if (size < bytes_written) {
cebdb522fd3edd Haren Myneni 2025-09-09 198 pr_err("Received the payload size = %d, but the buffer size = %d\n",
cebdb522fd3edd Haren Myneni 2025-09-09 199 bytes_written, size);
cebdb522fd3edd Haren Myneni 2025-09-09 200 bytes_written = size;
cebdb522fd3edd Haren Myneni 2025-09-09 201 }
cebdb522fd3edd Haren Myneni 2025-09-09 202 ret = copy_to_user(buf,
cebdb522fd3edd Haren Myneni 2025-09-09 203 rtas_work_area_raw_buf(work_area),
cebdb522fd3edd Haren Myneni 2025-09-09 204 bytes_written);
cebdb522fd3edd Haren Myneni 2025-09-09 205 if (!ret)
cebdb522fd3edd Haren Myneni 2025-09-09 206 ret = bytes_written;
Heh. Now ret either holds the number of bytes_written or the number of
bytes not written and we have no idea which it is.
if (copy_to_user(buf, rtas_work_area_raw_buf(work_area),
bytes_written))
ret = -EFAULT;
else
ret = bytes_written;
cebdb522fd3edd Haren Myneni 2025-09-09 207 }
cebdb522fd3edd Haren Myneni 2025-09-09 208 } else {
cebdb522fd3edd Haren Myneni 2025-09-09 209 pr_err("ibm,receive-hvpipe-msg failed with %d\n",
cebdb522fd3edd Haren Myneni 2025-09-09 210 ret);
cebdb522fd3edd Haren Myneni 2025-09-09 211 }
cebdb522fd3edd Haren Myneni 2025-09-09 212
cebdb522fd3edd Haren Myneni 2025-09-09 213 rtas_work_area_free(work_area);
cebdb522fd3edd Haren Myneni 2025-09-09 @214 return ret;
cebdb522fd3edd Haren Myneni 2025-09-09 215 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki