From: kernel test robot <lkp@intel.com>
To: Kees Cook <keescook@chromium.org>
Cc: kbuild-all@lists.01.org, linux-kernel@vger.kernel.org
Subject: drivers/video/fbdev/tdfxfb.c:1118:17: sparse: sparse: incorrect type in argument 1 (different address spaces)
Date: Wed, 10 Aug 2022 14:39:48 +0800 [thread overview]
Message-ID: <202208101431.245QhuXv-lkp@intel.com> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: d4252071b97d2027d246f6a82cbee4d52f618b47
commit: 28e77cc1c0686621a4d416f599cee5ab369daa0a fortify: Detect struct member overflows in memset() at compile-time
date: 6 months ago
config: mips-randconfig-s041-20220810 (https://download.01.org/0day-ci/archive/20220810/202208101431.245QhuXv-lkp@intel.com/config)
compiler: mipsel-linux-gcc (GCC) 12.1.0
reproduce:
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# apt-get install sparse
# sparse version: v0.6.4-39-gce1a6720-dirty
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=28e77cc1c0686621a4d416f599cee5ab369daa0a
git remote add linus https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
git fetch --no-tags linus master
git checkout 28e77cc1c0686621a4d416f599cee5ab369daa0a
# save the config file
mkdir build_dir && cp config build_dir/.config
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-12.1.0 make.cross C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' O=build_dir ARCH=mips SHELL=/bin/bash drivers/video/fbdev/
If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <lkp@intel.com>
sparse warnings: (new ones prefixed by >>)
>> drivers/video/fbdev/tdfxfb.c:1118:17: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got unsigned char [noderef] [usertype] __iomem *cursorbase @@
drivers/video/fbdev/tdfxfb.c:1118:17: sparse: expected void const *
drivers/video/fbdev/tdfxfb.c:1118:17: sparse: got unsigned char [noderef] [usertype] __iomem *cursorbase
>> drivers/video/fbdev/tdfxfb.c:1118:17: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got unsigned char [noderef] [usertype] __iomem *cursorbase @@
drivers/video/fbdev/tdfxfb.c:1118:17: sparse: expected void const *
drivers/video/fbdev/tdfxfb.c:1118:17: sparse: got unsigned char [noderef] [usertype] __iomem *cursorbase
drivers/video/fbdev/tdfxfb.c:1118:17: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got unsigned char [noderef] [usertype] __iomem *cursorbase @@
drivers/video/fbdev/tdfxfb.c:1118:17: sparse: expected void *
drivers/video/fbdev/tdfxfb.c:1118:17: sparse: got unsigned char [noderef] [usertype] __iomem *cursorbase
drivers/video/fbdev/tdfxfb.c:1129:33: sparse: sparse: cast removes address space '__iomem' of expression
drivers/video/fbdev/tdfxfb.c:1132:33: sparse: sparse: cast removes address space '__iomem' of expression
--
>> drivers/video/fbdev/sstfb.c:337:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got char [noderef] __iomem *screen_base @@
drivers/video/fbdev/sstfb.c:337:9: sparse: expected void const *
drivers/video/fbdev/sstfb.c:337:9: sparse: got char [noderef] __iomem *screen_base
>> drivers/video/fbdev/sstfb.c:337:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got char [noderef] __iomem *screen_base @@
drivers/video/fbdev/sstfb.c:337:9: sparse: expected void const *
drivers/video/fbdev/sstfb.c:337:9: sparse: got char [noderef] __iomem *screen_base
drivers/video/fbdev/sstfb.c:337:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got char [noderef] __iomem *screen_base @@
drivers/video/fbdev/sstfb.c:337:9: sparse: expected void *
drivers/video/fbdev/sstfb.c:337:9: sparse: got char [noderef] __iomem *screen_base
--
>> drivers/video/fbdev/aty/mach64_cursor.c:156:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got unsigned char [noderef] [usertype] __iomem *dst @@
drivers/video/fbdev/aty/mach64_cursor.c:156:13: sparse: expected void const *
drivers/video/fbdev/aty/mach64_cursor.c:156:13: sparse: got unsigned char [noderef] [usertype] __iomem *dst
>> drivers/video/fbdev/aty/mach64_cursor.c:156:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got unsigned char [noderef] [usertype] __iomem *dst @@
drivers/video/fbdev/aty/mach64_cursor.c:156:13: sparse: expected void const *
drivers/video/fbdev/aty/mach64_cursor.c:156:13: sparse: got unsigned char [noderef] [usertype] __iomem *dst
drivers/video/fbdev/aty/mach64_cursor.c:156:13: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got unsigned char [noderef] [usertype] __iomem *dst @@
drivers/video/fbdev/aty/mach64_cursor.c:156:13: sparse: expected void *
drivers/video/fbdev/aty/mach64_cursor.c:156:13: sparse: got unsigned char [noderef] [usertype] __iomem *dst
drivers/video/fbdev/aty/mach64_cursor.c:187:25: sparse: sparse: cast removes address space '__iomem' of expression
drivers/video/fbdev/aty/mach64_cursor.c:188:25: sparse: sparse: cast removes address space '__iomem' of expression
--
>> drivers/video/fbdev/kyro/fbdev.c:733:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got char [noderef] __iomem *screen_base @@
drivers/video/fbdev/kyro/fbdev.c:733:9: sparse: expected void const *
drivers/video/fbdev/kyro/fbdev.c:733:9: sparse: got char [noderef] __iomem *screen_base
>> drivers/video/fbdev/kyro/fbdev.c:733:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void const * @@ got char [noderef] __iomem *screen_base @@
drivers/video/fbdev/kyro/fbdev.c:733:9: sparse: expected void const *
drivers/video/fbdev/kyro/fbdev.c:733:9: sparse: got char [noderef] __iomem *screen_base
drivers/video/fbdev/kyro/fbdev.c:733:9: sparse: sparse: incorrect type in argument 1 (different address spaces) @@ expected void * @@ got char [noderef] __iomem *screen_base @@
drivers/video/fbdev/kyro/fbdev.c:733:9: sparse: expected void *
drivers/video/fbdev/kyro/fbdev.c:733:9: sparse: got char [noderef] __iomem *screen_base
vim +1118 drivers/video/fbdev/tdfxfb.c
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1038
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1039 static int tdfxfb_cursor(struct fb_info *info, struct fb_cursor *cursor)
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1040 {
a807f618b62594 drivers/video/tdfxfb.c Antonino A. Daplas 2006-01-09 1041 struct tdfx_par *par = info->par;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1042 u32 vidcfg;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1043
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1044 if (!hwcursor)
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1045 return -EINVAL; /* just to force soft_cursor() call */
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1046
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1047 /* Too large of a cursor or wrong bpp :-( */
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1048 if (cursor->image.width > 64 ||
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1049 cursor->image.height > 64 ||
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1050 cursor->image.depth > 1)
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1051 return -EINVAL;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1052
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1053 vidcfg = tdfx_inl(par, VIDPROCCFG);
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1054 if (cursor->enable)
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1055 tdfx_outl(par, VIDPROCCFG, vidcfg | VIDCFG_HWCURSOR_ENABLE);
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1056 else
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1057 tdfx_outl(par, VIDPROCCFG, vidcfg & ~VIDCFG_HWCURSOR_ENABLE);
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1058
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1059 /*
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1060 * If the cursor is not be changed this means either we want the
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1061 * current cursor state (if enable is set) or we want to query what
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1062 * we can do with the cursor (if enable is not set)
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1063 */
8af1d50f7f6793 drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1064 if (!cursor->set)
8af1d50f7f6793 drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1065 return 0;
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1066
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1067 /* fix cursor color - XFree86 forgets to restore it properly */
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1068 if (cursor->set & FB_CUR_SETCMAP) {
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1069 struct fb_cmap cmap = info->cmap;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1070 u32 bg_idx = cursor->image.bg_color;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1071 u32 fg_idx = cursor->image.fg_color;
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1072 unsigned long bg_color, fg_color;
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1073
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1074 fg_color = (((u32)cmap.red[fg_idx] & 0xff00) << 8) |
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1075 (((u32)cmap.green[fg_idx] & 0xff00) << 0) |
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1076 (((u32)cmap.blue[fg_idx] & 0xff00) >> 8);
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1077 bg_color = (((u32)cmap.red[bg_idx] & 0xff00) << 8) |
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1078 (((u32)cmap.green[bg_idx] & 0xff00) << 0) |
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1079 (((u32)cmap.blue[bg_idx] & 0xff00) >> 8);
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1080 banshee_make_room(par, 2);
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1081 tdfx_outl(par, HWCURC0, bg_color);
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1082 tdfx_outl(par, HWCURC1, fg_color);
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1083 }
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1084
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1085 if (cursor->set & FB_CUR_SETPOS) {
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1086 int x = cursor->image.dx;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1087 int y = cursor->image.dy - info->var.yoffset;
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1088
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1089 x += 63;
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1090 y += 63;
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1091 banshee_make_room(par, 1);
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1092 tdfx_outl(par, HWCURLOC, (y << 16) + x);
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1093 }
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1094 if (cursor->set & (FB_CUR_SETIMAGE | FB_CUR_SETSHAPE)) {
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1095 /*
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1096 * Voodoo 3 and above cards use 2 monochrome cursor patterns.
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1097 * The reason is so the card can fetch 8 words at a time
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1098 * and are stored on chip for use for the next 8 scanlines.
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1099 * This reduces the number of times for access to draw the
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1100 * cursor for each screen refresh.
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1101 * Each pattern is a bitmap of 64 bit wide and 64 bit high
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1102 * (total of 8192 bits or 1024 bytes). The two patterns are
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1103 * stored in such a way that pattern 0 always resides in the
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1104 * lower half (least significant 64 bits) of a 128 bit word
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1105 * and pattern 1 the upper half. If you examine the data of
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1106 * the cursor image the graphics card uses then from the
25985edcedea63 drivers/video/tdfxfb.c Lucas De Marchi 2011-03-30 1107 * beginning you see line one of pattern 0, line one of
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1108 * pattern 1, line two of pattern 0, line two of pattern 1,
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1109 * etc etc. The linear stride for the cursor is always 16 bytes
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1110 * (128 bits) which is the maximum cursor width times two for
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1111 * the two monochrome patterns.
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1112 */
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1113 u8 __iomem *cursorbase = info->screen_base + info->fix.smem_len;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1114 u8 *bitmap = (u8 *)cursor->image.data;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1115 u8 *mask = (u8 *)cursor->mask;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1116 int i;
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1117
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 @1118 fb_memset(cursorbase, 0, 1024);
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1119
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1120 for (i = 0; i < cursor->image.height; i++) {
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1121 int h = 0;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1122 int j = (cursor->image.width + 7) >> 3;
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1123
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1124 for (; j > 0; j--) {
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1125 u8 data = *mask ^ *bitmap;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1126 if (cursor->rop == ROP_COPY)
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1127 data = *mask & *bitmap;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1128 /* Pattern 0. Copy the cursor mask to it */
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1129 fb_writeb(*mask, cursorbase + h);
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1130 mask++;
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1131 /* Pattern 1. Copy the cursor bitmap to it */
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1132 fb_writeb(data, cursorbase + h + 8);
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1133 bitmap++;
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1134 h++;
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1135 }
90b0f08536531a drivers/video/tdfxfb.c Krzysztof Helt 2007-10-16 1136 cursorbase += 16;
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1137 }
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1138 }
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1139 return 0;
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1140 }
^1da177e4c3f41 drivers/video/tdfxfb.c Linus Torvalds 2005-04-16 1141
:::::: The code at line 1118 was first introduced by commit
:::::: 90b0f08536531abbbe7b5d4944792da08cadde01 tdfxfb: hardware cursor
:::::: TO: Krzysztof Helt <krzysztof.h1@wp.pl>
:::::: CC: Linus Torvalds <torvalds@woody.linux-foundation.org>
--
0-DAY CI Kernel Test Service
https://01.org/lkp
next reply other threads:[~2022-08-10 6:40 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2022-08-10 6:39 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2022-10-27 7:59 drivers/video/fbdev/tdfxfb.c:1118:17: sparse: sparse: incorrect type in argument 1 (different address spaces) kernel test robot
2022-05-13 0:29 kernel test robot
2022-04-07 0:23 kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202208101431.245QhuXv-lkp@intel.com \
--to=lkp@intel.com \
--cc=kbuild-all@lists.01.org \
--cc=keescook@chromium.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.