RE: Buggy commit tracked to: "Re: [PATCH 2/9] iov_iter: move rw_copy_check_uvector() into lib/iov_iter.c"
From: David Laight <hidden>
Date: 2020-10-23 12:46:48
Also in:
io-uring, keyrings, linux-arch, linux-arm-kernel, linux-block, linux-fsdevel, linux-mips, linux-mm, linux-s390, linux-scsi, linux-security-module, linuxppc-dev, lkml, sparclinux
From: Greg KH <gregkh@linuxfoundation.org>
Sent: 22 October 2020 14:51
I've rammed the code into godbolt. https://godbolt.org/z/9v5PPW Definitely a clang bug. Search for [wx]24 in the clang output. nr_segs comes in as w2 and the initial bound checks are done on w2. w24 is loaded from w2 - I don't believe this changes the high bits. There are no references to w24, just x24. So the kmalloc_array() is passed 'huge' and will fail. The iov_iter_init also gets the 64bit value. Note that the gcc code has a sign-extend copy of w2. David - Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)