Re: [PATCH v2 2/2] x86/uaccess: Drop the address space qualifier from put_user()

[David Laight]

On Wed, 23 Sep 2026 13:08:20 +0200
Ricardo Ribalda <ribalda@xxxxxxxxxxxx> wrote:

> Friendly ping?
> 
> On Mon, 14 Sept 2026 at 15:53, Ricardo Ribalda <ribalda@xxxxxxxxxxxx> wrote:
> >
> > __typeof__() preserves every qualifier, the address space included.
> >
> > When we do __typeof(*__user *int), we are declaring a __user integer,
> > which is pretty much meaningless. A value in a register or in the stack
> > does not live in the user address space.

Doesn't that mean it is a smatch bug - so should be fixed there.

Somewhere in the middle of this there ought to checks that the value
is the correct type (eg pointer v integer) and that, for put_user(),
the destination pointer isn't const.
Using:
	auto __x = 0 ? *ptr : x;
can be more succinct than other versions - might not help here.

David

> >
> > This annotation did not trigger any error until a recent version of
> > smatch[1] started caring. And as a result of that now we have tens of
> > warnings like:
> >
> >   drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
> >   drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    expected void const *from
> >   drivers/media/usb/uvc/uvc_v4l2.c:1112:13:    got unsigned int __user *
> >
> > Instead of __typeof__() use TYPEOF_UNQUAL(). It maps to
> > __typeof_unqual__() in recent compilers, so the address space annotation
> > is gone.
> >
> > [1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f
> >
> > Suggested-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> > Link: https://lore.kernel.org/r/20260825-unqual-v1-2-7024fb81b4f9@xxxxxxxxxxxx
> > Signed-off-by: Ricardo Ribalda <ribalda@xxxxxxxxxxxx>
> > ---
> >  arch/x86/include/asm/uaccess.h | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> >
> > diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
> > index 3a0dd3c2b233..4e576c0b9131 100644
> > --- a/arch/x86/include/asm/uaccess.h
> > +++ b/arch/x86/include/asm/uaccess.h
> > @@ -172,7 +172,7 @@ extern void __put_user_nocheck_8(void);
> >         int __ret_pu;                                                   \
> >         void __user *__ptr_pu;                                          \
> >         register __typeof__(*(ptr)) __val_pu asm("%"_ASM_AX);           \
> > -       __typeof__(*(ptr)) __x = (x); /* eval x once */                 \
> > +       TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */              \
> >         __typeof__(ptr) __ptr = (ptr); /* eval ptr once */              \
> >         __chk_user_ptr(__ptr);                                          \
> >         __ptr_pu = __ptr;                                               \
> > @@ -231,7 +231,7 @@ extern void __put_user_nocheck_8(void);
> >
> >  #define __put_user_size(x, ptr, size, label)                           \
> >  do {                                                                   \
> > -       __typeof__(*(ptr)) __x = (x); /* eval x once */                 \
> > +       TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */              \
> >         __typeof__(ptr) __ptr = (ptr); /* eval ptr once */              \
> >         __chk_user_ptr(__ptr);                                          \
> >         switch (size) {                                                 \
> >
> > --
> > 2.55.0.1007.g17ff1f9808-goog
> >  
> 
>