From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from us-smtp-delivery-124.mimecast.com ([63.128.21.124]:23331 "EHLO us-smtp-delivery-124.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750611AbgJWOdT (ORCPT ); Fri, 23 Oct 2020 10:33:19 -0400 Subject: Re: Buggy commit tracked to: "Re: [PATCH 2/9] iov_iter: move rw_copy_check_uvector() into lib/iov_iter.c" From: David Hildenbrand References: <20201022090155.GA1483166@kroah.com> <5fd6003b-55a6-2c3c-9a28-8fd3a575ca78@redhat.com> <20201022104805.GA1503673@kroah.com> <20201022121849.GA1664412@kroah.com> <98d9df88-b7ef-fdfb-7d90-2fa7a9d7bab5@redhat.com> <20201022125759.GA1685526@kroah.com> <20201022135036.GA1787470@kroah.com> <134f162d711d466ebbd88906fae35b33@AcuMS.aculab.com> <935f7168-c2f5-dd14-7124-412b284693a2@redhat.com> Message-ID: <999e2926-9a75-72fd-007a-1de0af341292@redhat.com> Date: Fri, 23 Oct 2020 16:33:03 +0200 MIME-Version: 1.0 In-Reply-To: <935f7168-c2f5-dd14-7124-412b284693a2@redhat.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit List-ID: To: David Laight , 'Greg KH' Cc: Al Viro , Nick Desaulniers , Christoph Hellwig , "kernel-team@android.com" , Andrew Morton , Jens Axboe , Arnd Bergmann , David Howells , "linux-arm-kernel@lists.infradead.org" , "linux-kernel@vger.kernel.org" , "linux-mips@vger.kernel.org" , "linux-parisc@vger.kernel.org" , "linuxppc-dev@lists.ozlabs.org" , "linux-s390@vger.kernel.org" , "sparclinux@vger.kernel.org" , "linux-block@vger.kernel.org" , "linux-scsi@vger.kernel.org" , "linux-fsdevel@vger.kernel.org" , "linux-aio@kvack.org" , "io-uring@vger.kernel.org" , "linux-arch@vger.kernel.org" , "linux-mm@kvack.org" , "netdev@vger.kernel.org" , "keyrings@vger.kernel.org" , "linux-security-module@vger.kernel.org" On 23.10.20 15:09, David Hildenbrand wrote: > On 23.10.20 14:46, David Laight wrote: >> From: Greg KH >>> Sent: 22 October 2020 14:51 >> >> I've rammed the code into godbolt. >> >> https://godbolt.org/z/9v5PPW >> >> Definitely a clang bug. >> >> Search for [wx]24 in the clang output. >> nr_segs comes in as w2 and the initial bound checks are done on w2. >> w24 is loaded from w2 - I don't believe this changes the high bits. >> There are no references to w24, just x24. >> So the kmalloc_array() is passed 'huge' and will fail. >> The iov_iter_init also gets the 64bit value. >> >> Note that the gcc code has a sign-extend copy of w2. > > Do we have a result from using "unsigned long" in the base function and > explicitly masking of the high bits? That should definitely work. > > Now, I am not a compiler expert, but as I already cited, at least on > x86-64 clang expects that the high bits were cleared by the caller - in > contrast to gcc. I suspect it's the same on arm64, but again, I am no > compiler expert. > > If what I said and cites for x86-64 is correct, if the function expects > an "unsigned int", it will happily use 64bit operations without further > checks where valid when assuming high bits are zero. That's why even > converting everything to "unsigned int" as proposed by me won't work on > clang - it assumes high bits are zero (as indicated by Nick). > > As I am neither a compiler experts (did I mention that already? ;) ) nor > an arm64 experts, I can't tell if this is a compiler BUG or not. > I just checked against upstream code generated by clang 10 and it properly discards the upper 32bit via a mov w23 w2. So at least clang 10 indeed properly assumes we could have garbage and masks it off. Maybe the issue is somewhere else, unrelated to nr_pages ... or clang 11 behaves differently. -- Thanks, David / dhildenb