[PATCH v2 2/2] x86/uaccess: Drop the address space qualifier from put_user()

From: Ricardo Ribalda

Date: Mon Sep 14 2026 - 11:48:54 EST


__typeof__() preserves every qualifier, the address space included.

When we do __typeof(*__user *int), we are declaring a __user integer,
which is pretty much meaningless. A value in a register or in the stack
does not live in the user address space.

This annotation did not trigger any error until a recent version of
smatch[1] started caring. And as a result of that now we have tens of
warnings like:

drivers/media/usb/uvc/uvc_v4l2.c:1112:13: warning: incorrect type in argument 2 (different address spaces)
drivers/media/usb/uvc/uvc_v4l2.c:1112:13: expected void const *from
drivers/media/usb/uvc/uvc_v4l2.c:1112:13: got unsigned int __user *

Instead of __typeof__() use TYPEOF_UNQUAL(). It maps to
__typeof_unqual__() in recent compilers, so the address space annotation
is gone.

[1] https://github.com/error27/smatch/commit/e53027a4e816a772403baafa83c09e4a94c1cb8f

Suggested-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20260825-unqual-v1-2-7024fb81b4f9@xxxxxxxxxxxx
Signed-off-by: Ricardo Ribalda <ribalda@xxxxxxxxxxxx>
---
arch/x86/include/asm/uaccess.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 3a0dd3c2b233..4e576c0b9131 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -172,7 +172,7 @@ extern void __put_user_nocheck_8(void);
int __ret_pu; \
void __user *__ptr_pu; \
register __typeof__(*(ptr)) __val_pu asm("%"_ASM_AX); \
- __typeof__(*(ptr)) __x = (x); /* eval x once */ \
+ TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */ \
__typeof__(ptr) __ptr = (ptr); /* eval ptr once */ \
__chk_user_ptr(__ptr); \
__ptr_pu = __ptr; \
@@ -231,7 +231,7 @@ extern void __put_user_nocheck_8(void);

#define __put_user_size(x, ptr, size, label) \
do { \
- __typeof__(*(ptr)) __x = (x); /* eval x once */ \
+ TYPEOF_UNQUAL(*(ptr)) __x = (x); /* eval x once */ \
__typeof__(ptr) __ptr = (ptr); /* eval ptr once */ \
__chk_user_ptr(__ptr); \
switch (size) { \

--
2.55.0.1007.g17ff1f9808-goog