]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
x86: __memcpy_flushcache: fix wrong alignment if size > 2^32
authorMikulas Patocka <mpatocka@redhat.com>
Tue, 19 Apr 2022 13:56:23 +0000 (09:56 -0400)
committerStefan Bader <stefan.bader@canonical.com>
Wed, 22 Jun 2022 12:22:57 +0000 (14:22 +0200)
commit92cedfca7b1d5a156f372ef68f4de89db0f96f71
tree334a2012fe8ccef62baa48f570e9121e57652d90
parent072c1f720b57167ef03b279ff58dfff72e3b5b48
x86: __memcpy_flushcache: fix wrong alignment if size > 2^32

BugLink: https://bugs.launchpad.net/bugs/1978234
[ Upstream commit a6823e4e360fe975bd3da4ab156df7c74c8b07f3 ]

The first "if" condition in __memcpy_flushcache is supposed to align the
"dest" variable to 8 bytes and copy data up to this alignment.  However,
this condition may misbehave if "size" is greater than 4GiB.

The statement min_t(unsigned, size, ALIGN(dest, 8) - dest); casts both
arguments to unsigned int and selects the smaller one.  However, the
cast truncates high bits in "size" and it results in misbehavior.

For example:

suppose that size == 0x100000001, dest == 0x200000002
min_t(unsigned, size, ALIGN(dest, 8) - dest) == min_t(0x1, 0xe) == 0x1;
...
dest += 0x1;

so we copy just one byte "and" dest remains unaligned.

This patch fixes the bug by replacing unsigned with size_t.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
arch/x86/lib/usercopy_64.c