From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev,
Linus Torvalds <torvalds@linux-foundation.org>
Subject: [PATCH 7.0 58/76] x86-64: rename misleadingly named __copy_user_nocache() function
Date: Mon, 20 Apr 2026 17:42:09 +0200 [thread overview]
Message-ID: <20260420153912.931958705@linuxfoundation.org> (raw)
In-Reply-To: <20260420153910.810034134@linuxfoundation.org>
7.0-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <torvalds@linux-foundation.org>
commit d187a86de793f84766ea40b9ade7ac60aabbb4fe upstream.
This function was a masterclass in bad naming, for various historical
reasons.
It claimed to be a non-cached user copy. It is literally _neither_ of
those things. It's a specialty memory copy routine that uses
non-temporal stores for the destination (but not the source), and that
does exception handling for both source and destination accesses.
Also note that while it works for unaligned targets, any unaligned parts
(whether at beginning or end) will not use non-temporal stores, since
only words and quadwords can be non-temporal on x86.
The exception handling means that it _can_ be used for user space
accesses, but not on its own - it needs all the normal "start user space
access" logic around it.
But typically the user space access would be the source, not the
non-temporal destination. That was the original intention of this,
where the destination was some fragile persistent memory target that
needed non-temporal stores in order to catch machine check exceptions
synchronously and deal with them gracefully.
Thus that non-descriptive name: one use case was to copy from user space
into a non-cached kernel buffer. However, the existing users are a mix
of that intended use-case, and a couple of random drivers that just did
this as a performance tweak.
Some of those random drivers then actively misused the user copying
version (with STAC/CLAC and all) to do kernel copies without ever even
caring about the exception handling, _just_ for the non-temporal
destination.
Rename it as a first small step to actually make it halfway sane, and
change the prototype to be more normal: it doesn't take a user pointer
unless the caller has done the proper conversion, and the argument size
is the full size_t (it still won't actually copy more than 4GB in one
go, but there's also no reason to silently truncate the size argument in
the caller).
Finally, use this now sanely named function in the NTB code, which
mis-used a user copy version (with STAC/CLAC and all) of this interface
despite it not actually being a user copy at all.
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/uaccess_64.h | 5 +++--
arch/x86/lib/copy_user_uncached_64.S | 6 +++---
arch/x86/lib/usercopy_64.c | 4 ++--
drivers/infiniband/sw/rdmavt/qp.c | 8 +++-----
drivers/ntb/ntb_transport.c | 7 ++++---
tools/objtool/check.c | 2 +-
6 files changed, 16 insertions(+), 16 deletions(-)
--- a/arch/x86/include/asm/uaccess_64.h
+++ b/arch/x86/include/asm/uaccess_64.h
@@ -147,7 +147,8 @@ raw_copy_to_user(void __user *dst, const
return copy_user_generic((__force void *)dst, src, size);
}
-extern long __copy_user_nocache(void *dst, const void __user *src, unsigned size);
+#define copy_to_nontemporal copy_to_nontemporal
+extern size_t copy_to_nontemporal(void *dst, const void *src, size_t size);
extern long __copy_user_flushcache(void *dst, const void __user *src, unsigned size);
static inline int
@@ -157,7 +158,7 @@ __copy_from_user_inatomic_nocache(void *
long ret;
kasan_check_write(dst, size);
stac();
- ret = __copy_user_nocache(dst, src, size);
+ ret = copy_to_nontemporal(dst, (__force const void *)src, size);
clac();
return ret;
}
--- a/arch/x86/lib/copy_user_uncached_64.S
+++ b/arch/x86/lib/copy_user_uncached_64.S
@@ -27,7 +27,7 @@
* Output:
* rax uncopied bytes or 0 if successful.
*/
-SYM_FUNC_START(__copy_user_nocache)
+SYM_FUNC_START(copy_to_nontemporal)
ANNOTATE_NOENDBR
/* If destination is not 7-byte aligned, we'll have to align it */
testb $7,%dil
@@ -240,5 +240,5 @@ _ASM_EXTABLE_UA(95b, .Ldone)
_ASM_EXTABLE_UA(52b, .Ldone0)
_ASM_EXTABLE_UA(53b, .Ldone0)
-SYM_FUNC_END(__copy_user_nocache)
-EXPORT_SYMBOL(__copy_user_nocache)
+SYM_FUNC_END(copy_to_nontemporal)
+EXPORT_SYMBOL(copy_to_nontemporal)
--- a/arch/x86/lib/usercopy_64.c
+++ b/arch/x86/lib/usercopy_64.c
@@ -49,11 +49,11 @@ long __copy_user_flushcache(void *dst, c
long rc;
stac();
- rc = __copy_user_nocache(dst, src, size);
+ rc = copy_to_nontemporal(dst, (__force const void *)src, size);
clac();
/*
- * __copy_user_nocache() uses non-temporal stores for the bulk
+ * copy_to_nontemporal() uses non-temporal stores for the bulk
* of the transfer, but we need to manually flush if the
* transfer is unaligned. A cached memory copy is used when
* destination or size is not naturally aligned. That is:
--- a/drivers/infiniband/sw/rdmavt/qp.c
+++ b/drivers/infiniband/sw/rdmavt/qp.c
@@ -92,12 +92,10 @@ static int rvt_wss_llc_size(void)
static void cacheless_memcpy(void *dst, void *src, size_t n)
{
/*
- * Use the only available X64 cacheless copy. Add a __user cast
- * to quiet sparse. The src agument is already in the kernel so
- * there are no security issues. The extra fault recovery machinery
- * is not invoked.
+ * Use the only available X64 cacheless copy.
+ * The extra fault recovery machinery is not invoked.
*/
- __copy_user_nocache(dst, (void __user *)src, n);
+ copy_to_nontemporal(dst, src, n);
}
void rvt_wss_exit(struct rvt_dev_info *rdi)
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -1779,12 +1779,13 @@ static void ntb_tx_copy_callback(void *d
static void ntb_memcpy_tx_on_stack(struct ntb_queue_entry *entry, void __iomem *offset)
{
-#ifdef ARCH_HAS_NOCACHE_UACCESS
+#ifdef copy_to_nontemporal
/*
* Using non-temporal mov to improve performance on non-cached
- * writes, even though we aren't actually copying from user space.
+ * writes. This only works if __iomem is strictly memory-like,
+ * but that is the case on x86-64
*/
- __copy_from_user_inatomic_nocache(offset, entry->buf, entry->len);
+ copy_to_nontemporal(offset, entry->buf, entry->len);
#else
memcpy_toio(offset, entry->buf, entry->len);
#endif
--- a/tools/objtool/check.c
+++ b/tools/objtool/check.c
@@ -1301,7 +1301,7 @@ static const char *uaccess_safe_builtin[
"copy_mc_enhanced_fast_string",
"rep_stos_alternative",
"rep_movs_alternative",
- "__copy_user_nocache",
+ "copy_to_nontemporal",
NULL
};
next prev parent reply other threads:[~2026-04-20 15:45 UTC|newest]
Thread overview: 88+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-20 15:41 [PATCH 7.0 00/76] 7.0.1-rc1 review Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 01/76] nfc: llcp: add missing return after LLCP_CLOSED checks Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 02/76] x86/CPU: Fix FPDSS on Zen1 Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 03/76] can: raw: fix ro->uniq use-after-free in raw_rcv() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 04/76] i2c: s3c24xx: check the size of the SMBUS message before using it Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 05/76] staging: rtl8723bs: initialize le_tmp64 in rtw_BIP_verify() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 06/76] HID: alps: fix NULL pointer dereference in alps_raw_event() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 07/76] HID: core: clamp report_size in s32ton() to avoid undefined shift Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 08/76] net: usb: cdc-phonet: fix skb frags[] overflow in rx_complete() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 09/76] NFC: digital: Bounds check NFC-A cascade depth in SDD response handler Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 10/76] drm/vc4: platform_get_irq_byname() returns an int Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 11/76] bnge: return after auxiliary_device_uninit() in error path Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 12/76] ALSA: usx2y: us144mkii: fix NULL deref on missing interface 0 Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 13/76] ALSA: fireworks: bound device-supplied status before string array lookup Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 14/76] fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 15/76] usb: gadget: f_ncm: validate minimum block_len in ncm_unwrap_ntb() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 16/76] usb: gadget: f_phonet: fix skb frags[] overflow in pn_rx_complete() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 17/76] usb: gadget: renesas_usb3: validate endpoint index in standard request handlers Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 18/76] smb: client: fix off-by-8 bounds check in check_wsl_eas() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 19/76] smb: client: fix OOB reads parsing symlink error response Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 20/76] ksmbd: validate EaNameLength in smb2_get_ea() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 21/76] ksmbd: require 3 sub-authorities before reading sub_auth[2] Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 22/76] ksmbd: fix mechToken leak when SPNEGO decode fails after token alloc Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 23/76] smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 24/76] smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 25/76] usbip: validate number_of_packets in usbip_pack_ret_submit() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 26/76] usb: typec: fusb302: Switch to threaded IRQ handler Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 27/76] usb: storage: Expand range of matched versions for VL817 quirks entry Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 28/76] USB: cdc-acm: Add quirks for Yoga Book 9 14IAH10 INGENIC touchscreen Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 29/76] usb: gadget: f_hid: dont call cdev_init while cdev in use Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 30/76] usb: port: add delay after usb_hub_set_port_power() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 31/76] fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 32/76] scripts/gdb/symbols: handle module path parameters Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 33/76] scripts: generate_rust_analyzer.py: avoid FD leak Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 34/76] wifi: rtw88: fix device leak on probe failure Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 35/76] staging: sm750fb: fix division by zero in ps_to_hz() Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 36/76] selftests/mm: hmm-tests: dont hardcode THP size to 2MB Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 37/76] USB: serial: option: add Telit Cinterion FN990A MBIM composition Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 38/76] Docs/admin-guide/mm/damon/reclaim: warn commit_inputs vs param updates race Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 39/76] Docs/admin-guide/mm/damon/lru_sort: " Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 40/76] ALSA: ctxfi: Limit PTP to a single page Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 41/76] dcache: Limit the minimal number of bucket to two Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 42/76] vfio/xe: Reorganize the init to decouple migration from reset Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 43/76] arm64: mm: Handle invalid large leaf mappings correctly Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 44/76] media: vidtv: fix NULL pointer dereference in vidtv_channel_pmt_match_sections Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 45/76] ocfs2: fix possible deadlock between unlink and dio_end_io_write Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 46/76] ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 47/76] ocfs2: handle invalid dinode in ocfs2_group_extend Greg Kroah-Hartman
2026-04-20 15:41 ` [PATCH 7.0 48/76] PCI: endpoint: pci-epf-vntb: Stop cmd_handler work in epf_ntb_epc_cleanup Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 49/76] PCI: endpoint: pci-epf-vntb: Remove duplicate resource teardown Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 50/76] KVM: selftests: Remove duplicate LAUNCH_UPDATE_VMSA call in SEV-ES migrate test Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 51/76] KVM: SEV: Reject attempts to sync VMSA of an already-launched/encrypted vCPU Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 52/76] KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 53/76] KVM: SEV: Disallow LAUNCH_FINISH if vCPUs are actively being created Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 54/76] KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 55/76] KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 56/76] mm: call ->free_folio() directly in folio_unmap_invalidate() Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 57/76] checkpatch: add support for Assisted-by tag Greg Kroah-Hartman
2026-04-20 15:42 ` Greg Kroah-Hartman [this message]
2026-04-20 15:42 ` [PATCH 7.0 59/76] x86: rename and clean up __copy_from_user_inatomic_nocache() Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 60/76] x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 61/76] KVM: x86: Use scratch field in MMIO fragment to hold small write values Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 62/76] ASoC: qcom: q6apm: move component registration to unmanaged version Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 63/76] mm/kasan: fix double free for kasan pXds Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 64/76] mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 65/76] media: vidtv: fix nfeeds state corruption on start_streaming failure Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 66/76] media: mediatek: vcodec: fix use-after-free in encoder release path Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 67/76] media: em28xx: fix use-after-free in em28xx_v4l2_open() Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 68/76] hwmon: (powerz) Fix use-after-free on USB disconnect Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 69/76] ALSA: 6fire: fix use-after-free on disconnect Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 70/76] bcache: fix cached_dev.sb_bio use-after-free and crash Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 71/76] wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 72/76] media: as102: fix to not free memory after the device is registered in as102_usb_probe() Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 73/76] nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 74/76] media: vidtv: fix pass-by-value structs causing MSAN warnings Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 75/76] media: hackrf: fix to not free memory after the device is registered in hackrf_probe() Greg Kroah-Hartman
2026-04-20 15:42 ` [PATCH 7.0 76/76] mm/userfaultfd: fix hugetlb fault mutex hash calculation Greg Kroah-Hartman
2026-04-20 17:32 ` [PATCH 7.0 00/76] 7.0.1-rc1 review Ronald Warsow
2026-04-20 18:17 ` Florian Fainelli
2026-04-20 21:58 ` Luna Jernberg
2026-04-20 22:28 ` Peter Schneider
2026-04-20 23:08 ` Takeshi Ogasawara
2026-04-21 6:52 ` Ron Economos
2026-04-21 8:09 ` Brett A C Sheffield
2026-04-21 10:22 ` Miguel Ojeda
2026-04-21 16:45 ` Shuah Khan
2026-04-21 16:47 ` Josh Law
2026-04-21 20:04 ` Mark Brown
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260420153912.931958705@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=patches@lists.linux.dev \
--cc=stable@vger.kernel.org \
--cc=torvalds@linux-foundation.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox