Re: Buggy commit tracked to: "Re: [PATCH 2/9] iov_iter: move rw_copy_check_uvector() into lib/iov_iter.c"
From: Al Viro <viro@zeniv.linux.org.uk>
Date: 2020-10-22 19:27:38
Also in:
io-uring, keyrings, linux-arch, linux-arm-kernel, linux-block, linux-fsdevel, linux-mips, linux-mm, linux-s390, linux-scsi, linux-security-module, lkml, netdev, sparclinux
On Thu, Oct 22, 2020 at 08:24:58PM +0100, Al Viro wrote:
On Thu, Oct 22, 2020 at 12:04:52PM -0700, Nick Desaulniers wrote:quoted
Passing an `unsigned long` as an `unsigned int` does no such narrowing: https://godbolt.org/z/TvfMxe (same vice-versa, just tail calls, no masking instructions). So if rw_copy_check_uvector() is inlined into import_iovec() (looking at the mainline@1028ae406999), then children calls of `rw_copy_check_uvector()` will be interpreting the `nr_segs` register unmodified, ie. garbage in the upper 32b.FWIW, void f(unsinged long v)
s/unsinged/unsigned/, obviously...