linux-kernel - Re: include/linux/ucopysize.h:45:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <202508251728.D5CA199F35@keescook>
Date: Mon, 25 Aug 2025 17:31:51 -0700
From: Kees Cook <kees@...nel.org>
To: kernel test robot <lkp@...el.com>,
	Nathan Chancellor <nathan@...nel.org>
Cc: llvm@...ts.linux.dev, oe-kbuild-all@...ts.linux.dev,
	linux-kernel@...r.kernel.org
Subject: Re: include/linux/ucopysize.h:45:4: error: call to '__bad_copy_from'
 declared with 'error' attribute: copy source size is too small

On Wed, Aug 06, 2025 at 03:49:28AM +0800, kernel test robot wrote:
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
> head:   6bcdbd62bd56e6d7383f9e06d9d148935b3c9b73
> commit: 808aac63e2bdf9bae08485e072bf3d317a18acbf uaccess: Introduce ucopysize.h
> date:   5 months ago
> config: um-randconfig-001-20250806 (https://download.01.org/0day-ci/archive/20250806/202508060351.OMeX2wGa-lkp@intel.com/config)

The option inducing the miscompile (the "len" argument gets turned into
a compiler-constant value +1 from where it actually should be across the
inlinings of copy_to_user) is, *drum roll*  -fsanitize=alignment

So, I think we need to ban CONFIG_UBSAN_ALIGNMENT on at least on x86...

-Kees

> compiler: clang version 16.0.6 (https://github.com/llvm/llvm-project 7cbf1a2591520c2491aa35339f227775f4d3adf6)
> reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250806/202508060351.OMeX2wGa-lkp@intel.com/reproduce)
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <lkp@...el.com>
> | Closes: https://lore.kernel.org/oe-kbuild-all/202508060351.OMeX2wGa-lkp@intel.com/
> 
> All errors (new ones prefixed by >>):
> 
>    In file included from net/sctp/socket.c:45:
>    In file included from include/linux/sched/signal.h:9:
>    In file included from include/linux/sched/task.h:13:
>    In file included from include/linux/uaccess.h:10:
> >> include/linux/ucopysize.h:45:4: error: call to '__bad_copy_from' declared with 'error' attribute: copy source size is too small
>                            __bad_copy_from();
>                            ^
>    1 error generated.
> 
> 
> vim +45 include/linux/ucopysize.h
> 
>     36	
>     37	static __always_inline __must_check bool
>     38	check_copy_size(const void *addr, size_t bytes, bool is_source)
>     39	{
>     40		int sz = __builtin_object_size(addr, 0);
>     41		if (unlikely(sz >= 0 && sz < bytes)) {
>     42			if (!__builtin_constant_p(bytes))
>     43				copy_overflow(sz, bytes);
>     44			else if (is_source)
>   > 45				__bad_copy_from();
>     46			else
>     47				__bad_copy_to();
>     48			return false;
>     49		}
>     50		if (WARN_ON_ONCE(bytes > INT_MAX))
>     51			return false;
>     52		check_object_size(addr, bytes, is_source);
>     53		return true;
>     54	}
>     55	
> 
> -- 
> 0-DAY CI Kernel Test Service
> https://github.com/intel/lkp-tests/wiki

-- 
Kees Cook