From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from verein.lst.de ([213.95.11.211]:52840 "EHLO verein.lst.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2442738AbgJVNXs (ORCPT ); Thu, 22 Oct 2020 09:23:48 -0400 Date: Thu, 22 Oct 2020 15:23:42 +0200 From: Christoph Hellwig Subject: Re: Buggy commit tracked to: "Re: [PATCH 2/9] iov_iter: move rw_copy_check_uvector() into lib/iov_iter.c" Message-ID: <20201022132342.GB8781@lst.de> References: <20201021233914.GR3576660@ZenIV.linux.org.uk> <20201022082654.GA1477657@kroah.com> <80a2e5fa-718a-8433-1ab0-dd5b3e3b5416@redhat.com> <5d2ecb24db1e415b8ff88261435386ec@AcuMS.aculab.com> <20201022090155.GA1483166@kroah.com> <5fd6003b-55a6-2c3c-9a28-8fd3a575ca78@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5fd6003b-55a6-2c3c-9a28-8fd3a575ca78@redhat.com> List-ID: To: David Hildenbrand Cc: David Laight , Greg KH , Al Viro , Nick Desaulniers , Christoph Hellwig , "kernel-team@android.com" , Andrew Morton , Jens Axboe , Arnd Bergmann , David Howells , "linux-arm-kernel@lists.infradead.org" , "linux-kernel@vger.kernel.org" , "linux-mips@vger.kernel.org" , "linux-parisc@vger.kernel.org" , "linuxppc-dev@lists.ozlabs.org" , "linux-s390@vger.kernel.org" , "sparclinux@vger.kernel.org" , "linux-block@vger.kernel.org" , "linux-scsi@vger.kernel.org" , "linux-fsdevel@vger.kernel.org" , "linux-aio@kvack.org" , "io-uring@vger.kernel.org" , "linux-arch@vger.kernel.org" , "linux-mm@kvack.org" , "netdev@vger.kernel.org" , "keyrings@vger.kernel.org" , "linux-security-module@vger.kernel.org" On Thu, Oct 22, 2020 at 11:36:40AM +0200, David Hildenbrand wrote: > My thinking: if the compiler that calls import_iovec() has garbage in > the upper 32 bit > > a) gcc will zero it out and not rely on it being zero. > b) clang will not zero it out, assuming it is zero. > > But > > a) will zero it out when calling the !inlined variant > b) clang will zero it out when calling the !inlined variant > > When inlining, b) strikes. We access garbage. That would mean that we > have calling code that's not generated by clang/gcc IIUC. Most callchains of import_iovec start with the assembly syscall wrappers.