[CHECKER] Clarifications needed on a user-pointer false alarm in

[Junfeng Yang]

Hi,

I got the following false alarm in kernel/kmod.c.

the call chain is sys_wait4 (_, &sub_info->retval) -> wait_task_zombie (_,
_, stat_addr, _) -> put_user (_, stat_addr), which means &sub_info->retval
will be passed into put_user. From the calling context, sub_info should be
in kernel space, so &sub_info->retval should be in kernel space as well.
The explanation for this false alarm could be that the call chain wasn't
realistic, but I'm not sure. Can you guys please help me on that?

/home/junfeng/linux-tainted/kernel/kmod.c:185:wait_for_helper:
ERROR:TAINTED:185:185: dereferencing tainted ptr 'sub_info' [Callstack: ]
  if (pid < 0)
            sub_info->retval = pid;
 else
            sys_wait4(pid, (unsigned int *)&sub_info->retval, 0, NULL);

Error --->
   complete(sub_info->complete);
   return 0;
}