load_unaligned_zeropad() is inline assembly, so KASAN and KCSAN never see the word loads that sized_strscpy(), the dcache name compare, path name hashing and x86 csum_partial() do through it. While reviewing a strscpy() KASAN fix, Peter Collingbourne suggested checking the first byte inside load_unaligned_zeropad() itself, as read_word_at_a_time() does [1].
Patch 1 adds that check on the six architectures that implement load_unaligned_zeropad(). Patch 2 adds a KASAN KUnit case for it. [1] https://lore.kernel.org/r/capqlkrhxzwozmfhnd_pex1ihwdh1_5qthp6panyj_m-v9vf...@mail.gmail.com Signed-off-by: Qiliang Yuan <[email protected]> --- V1 -> V2: - Call instrument_read() instead of open-coding it (Andrey Ryabinin) - Keep Marco Elver's Reviewed-by, as the check itself is unchanged - Rebase onto 7be4bc52fd9e, which drops the big-endian branch of the arm64 header and rewrites the s390 load_unaligned_zeropad() v1: https://lore.kernel.org/r/20261019-bug-word-at-a-time-zeropad-kasan-v1-0-f21a3ed6a...@gmail.com --- Qiliang Yuan (2): word-at-a-time: check the first byte in load_unaligned_zeropad() kasan/test: cover load_unaligned_zeropad() arch/arm/include/asm/word-at-a-time.h | 5 +++++ arch/arm64/include/asm/word-at-a-time.h | 4 ++++ arch/powerpc/include/asm/word-at-a-time.h | 4 ++++ arch/riscv/include/asm/word-at-a-time.h | 4 ++++ arch/s390/include/asm/word-at-a-time.h | 4 ++++ arch/x86/include/asm/word-at-a-time.h | 4 ++++ mm/kasan/kasan_test_c.c | 24 ++++++++++++++++++++++ .../powerpc/primitives/linux/instrumented.h | 3 +++ 8 files changed, 52 insertions(+) --- base-commit: 7be4bc52fd9e0e55dc9a2e0232b89427d2c4b614 change-id: 20261019-bug-word-at-a-time-zeropad-kasan-af2460466ee6 Best regards, -- Qiliang Yuan <[email protected]>
