Messages in this thread | | | From | David Laight <> | Subject | RE: Buggy commit tracked to: "Re: [PATCH 2/9] iov_iter: move rw_copy_check_uvector() into lib/iov_iter.c" | Date | Fri, 23 Oct 2020 12:46:36 +0000 |
| |
From: Greg KH <gregkh@linuxfoundation.org> > Sent: 22 October 2020 14:51
I've rammed the code into godbolt.
https://godbolt.org/z/9v5PPW
Definitely a clang bug.
Search for [wx]24 in the clang output. nr_segs comes in as w2 and the initial bound checks are done on w2. w24 is loaded from w2 - I don't believe this changes the high bits. There are no references to w24, just x24. So the kmalloc_array() is passed 'huge' and will fail. The iov_iter_init also gets the 64bit value.
Note that the gcc code has a sign-extend copy of w2.
David
- Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK Registration No: 1397386 (Wales)
| |