Re: include/linux/ucopysize.h:45:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small

[Kees Cook <kees@kernel.org>]

On Wed, Aug 06, 2025 at 03:49:28AM +0800, kernel test robot wrote:
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head:   6bcdbd62bd56e6d7383f9e06d9d148935b3c9b73
> commit: 808aac63e2bdf9bae08485e072bf3d317a18acbf uaccess: Introduce ucopysize.h
> date:   5 months ago
> config: um-randconfig-001-20250806 (https://download.01.org/0day-ci/archive/20250806/202508060351.OMeX2wGa-lkp@intel.com/config)

The option inducing the miscompile (the "len" argument gets turned into
a compiler-constant value +1 from where it actually should be across the
inlinings of copy_to_user) is, *drum roll*  -fsanitize=alignment

So, I think we need to ban CONFIG_UBSAN_ALIGNMENT on at least on x86...

-Kees

> compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6)
> reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250806/202508060351.OMeX2wGa-lkp@intel.com/reproduce)
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@intel.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202508060351.OMeX2wGa-lkp@intel.com/
> 
> All errors (new ones prefixed by >>):
> 
>    In file included from net/sctp/socket.c:45:
>    In file included from include/linux/sched/signal.h:9:
>    In file included from include/linux/sched/task.h:13:
>    In file included from include/linux/uaccess.h:10:
> >> include/linux/ucopysize.h:45:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small
>                            __bad_copy_from();
>                            ^
>    1 error generated.
> 
> 
> vim +45 include/linux/ucopysize.h
> 
>     36	
>     37	static __always_inline __must_check bool
>     38	check_copy_size(const void *addr, size_t bytes, bool is_source)
>     39	{
>     40		int sz = __builtin_object_size(addr, 0);
>     41		if (unlikely(sz >= 0 && sz < bytes)) {
>     42			if (!__builtin_constant_p(bytes))
>     43				copy_overflow(sz, bytes);
>     44			else if (is_source)
>   > 45				__bad_copy_from();
>     46			else
>     47				__bad_copy_to();
>     48			return false;
>     49		}
>     50		if (WARN_ON_ONCE(bytes > INT_MAX))
>     51			return false;
>     52		check_object_size(addr, bytes, is_source);
>     53		return true;
>     54	}
>     55	
> 
> -- 
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki

-- 
Kees Cook