Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

sparc: fix accurate exception reporting in copy_{from_to}_user for UltraSPARC III

Anthony Yznaga tracked down that a BUG_ON in ext4 code with large folios
enabled resulted from copy_from_user() returning impossibly large values
greater than the size to be copied. This lead to __copy_from_iter()
returning impossible values instead of the actual number of bytes it was
able to copy.

The BUG_ON has been reported in
https://lore.kernel.org/r/b14f55642207e63e907965e209f6323a0df6dcee.camel@physik.fu-berlin.de

The referenced commit introduced exception handlers on user-space memory
references in copy_from_user and copy_to_user. These handlers return from
the respective function and calculate the remaining bytes left to copy
using the current register contents. The exception handlers expect that
%o2 has already been masked during the bulk copy loop, but the masking was
performed after that loop. This will fix the return value of copy_from_user
and copy_to_user in the faulting case. The behaviour of memcpy stays
unchanged.

Fixes: ee841d0aff64 ("sparc64: Convert U3copy_{from,to}_user to accurate exception reporting.")
Tested-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de> # on Sun Netra 240
Reviewed-by: Anthony Yznaga <anthony.yznaga@oracle.com>
Tested-by: René Rebe <rene@exactcode.com> # on UltraSparc III+ and UltraSparc IIIi
Signed-off-by: Michael Karcher <kernel@mkarcher.dialup.fu-berlin.de>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Link: https://lore.kernel.org/r/20250905-memcpy_series-v4-2-1ca72dda195b@mkarcher.dialup.fu-berlin.de
Signed-off-by: Andreas Larsson <andreas@gaisler.com>

authored by

Michael Karcher and committed by
Andreas Larsson
47b49c06 4fba1713

+1 -1
+1 -1
arch/sparc/lib/U3memcpy.S
··· 267 267 faligndata %f10, %f12, %f26 268 268 EX_LD_FP(LOAD(ldd, %o1 + 0x040, %f0), U3_retl_o2) 269 269 270 + and %o2, 0x3f, %o2 270 271 subcc GLOBAL_SPARE, 0x80, GLOBAL_SPARE 271 272 add %o1, 0x40, %o1 272 273 bgu,pt %XCC, 1f ··· 337 336 * Also notice how this code is careful not to perform a 338 337 * load past the end of the src buffer. 339 338 */ 340 - and %o2, 0x3f, %o2 341 339 andcc %o2, 0x38, %g2 342 340 be,pn %XCC, 2f 343 341 subcc %g2, 0x8, %g2