Re: [PATCH v3 14/15] iommufd: vfio container FD ioctl compatibility

[Baolu Lu <baolu.lu@xxxxxxxxxxxxxxx>]

On 2022/10/26 2:12, Jason Gunthorpe wrote:
> +static int iommufd_fill_cap_iova(struct iommufd_ioas *ioas,
> +				 struct vfio_info_cap_header __user *cur,
> +				 size_t avail)
> +{
> +	struct vfio_iommu_type1_info_cap_iova_range __user *ucap_iovas =
> +		container_of(cur,
> +			     struct vfio_iommu_type1_info_cap_iova_range __user,
> +			     header);
> +	struct vfio_iommu_type1_info_cap_iova_range cap_iovas = {
> +		.header = {
> +			.id = VFIO_IOMMU_TYPE1_INFO_CAP_IOVA_RANGE,
> +			.version = 1,
> +		},
> +	};
> +	struct interval_tree_span_iter span;

Intel 0day robot reported:

commit: 954c5e0297d664c7f46c628b3151567b53afe153 [14/15] iommufd: vfio 
container FD ioctl compatibility
config: m68k-randconfig-s053-20221104 (attached as .config)
compiler: m68k-linux-gcc (GCC) 12.1.0
reproduce:
        wget 
https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross 
-O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # apt-get install sparse
        # sparse version: v0.6.4-39-gce1a6720-dirty
        git remote add internal-blu2-usb 
git://bee.sh.intel.com/git/blu2/usb.git
        git fetch --no-tags internal-blu2-usb iommu/iommufd/v3
        git checkout 954c5e0297d664c7f46c628b3151567b53afe153
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross 
C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' O=build_dir ARCH=m68k 
SHELL=/bin/bash drivers/iommu/iommufd/

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@xxxxxxxxx>

sparse warnings: (new ones prefixed by >>)
>> drivers/iommu/iommufd/vfio_compat.c:294:17: sparse: sparse: cast 
removes address space '__user' of expression

vim +/__user +294 drivers/iommu/iommufd/vfio_compat.c

   288	
   289	static int iommufd_fill_cap_iova(struct iommufd_ioas *ioas,
   290					 struct vfio_info_cap_header __user *cur,
   291					 size_t avail)
   292	{
   293		struct vfio_iommu_type1_info_cap_iova_range __user *ucap_iovas =
 > 294			container_of(cur,
   295				     struct vfio_iommu_type1_info_cap_iova_range __user,
   296				     header);
   297		struct vfio_iommu_type1_info_cap_iova_range cap_iovas = {
   298			.header = {
   299				.id = VFIO_IOMMU_TYPE1_INFO_CAP_IOVA_RANGE,
   300				.version = 1,
   301			},
   302		};
   303		struct interval_tree_span_iter span;
   304	
   305		interval_tree_for_each_span(&span, &ioas->iopt.reserved_itree, 0,
   306					    ULONG_MAX) {
   307			struct vfio_iova_range range;
   308	
   309			if (!span.is_hole)
   310				continue;
   311			range.start = span.start_hole;
   312			range.end = span.last_hole;
   313			if (avail >= struct_size(&cap_iovas, iova_ranges,
   314						 cap_iovas.nr_iovas + 1) &&
   315			    copy_to_user(&ucap_iovas->iova_ranges[cap_iovas.nr_iovas],
   316					 &range, sizeof(range)))
   317				return -EFAULT;
   318			cap_iovas.nr_iovas++;
   319		}
   320		if (avail >= struct_size(&cap_iovas, iova_ranges, 
cap_iovas.nr_iovas) &&
   321		    copy_to_user(ucap_iovas, &cap_iovas, sizeof(cap_iovas)))
   322			return -EFAULT;
   323		return struct_size(&cap_iovas, iova_ranges, cap_iovas.nr_iovas);
   324	}
   325	

Best regards,
baolu