Re: [PATCH] arm64: compat: Keep alignment address arithmetic 32-bit

[Karl Mehltretter <kmehltretter@gmail.com>]

On Mon, Aug 17, 2026 at 11:15:33AM +0100, Arnd Bergmann wrote:
> Nice find! How did you come across this?

Hi Arnd,

This didn't start as a real world bug hunt. I only recently became
aware of the compat alignment fixups and wanted to see how the
implementation differed from the arm32 one.

This is the only issue I found that was a regression from the arm32
implementation, and it looks like this can happen in real usage.

> As I understand it, the underlying problem here is the
> 32-bit overflow of nr_regs. Wouldn't it be sufficient
> to just turn nr_regs into an 'unsigned long' or 'size_t'

You are right that simply widening nr_regs fixes the incorrect address
arithmetic for decrementing LDM/STM transfers.

The 4 GiB wraparound case is possible with a rather unusual arm64
kernel configuration, and correctly handling an individual word
crossing the boundary would require byte accesses. That seems too
contrived to justify the extra complexity here.

Just to be sure by "both instances" do you mean the nr_regs
declarations in both arch/arm64/kernel/compat_alignment.c and
arch/arm/mm/alignment.c?

Changing nr_regs in arm32 alignment.c would not change the generated
code and I guess probably not be backported, so that would create a
divergence with stable kernels.

Would you prefer changing both files, or only the arm64 implementation?

Thanks,
Karl