• Mikulas Patocka's avatar
    x86: __memcpy_flushcache: fix wrong alignment if size > 2^32 · a6823e4e
    Mikulas Patocka authored
    The first "if" condition in __memcpy_flushcache is supposed to align the
    "dest" variable to 8 bytes and copy data up to this alignment.  However,
    this condition may misbehave if "size" is greater than 4GiB.
    
    The statement min_t(unsigned, size, ALIGN(dest, 8) - dest); casts both
    arguments to unsigned int and selects the smaller one.  However, the
    cast truncates high bits in "size" and it results in misbehavior.
    
    For example:
    
    	suppose that size == 0x100000001, dest == 0x200000002
    	min_t(unsigned, size, ALIGN(dest, 8) - dest) == min_t(0x1, 0xe) == 0x1;
    	...
    	dest += 0x1;
    
    so we copy just one byte "and" dest remains unaligned.
    
    This patch fixes the bug by replacing unsigned with size_t.
    Signed-off-by: default avatarMikulas Patocka <mpatocka@redhat.com>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    a6823e4e
usercopy_64.c 4.51 KB