From nobody Wed Sep 30 05:01:22 2026 Received: from mail-wr1-f47.google.com (mail-wr1-f47.google.com [209.85.221.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E506A2F1FED for ; Wed, 12 Aug 2026 18:51:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.47 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786560667; cv=none; b=uixOBGMO84AN9dmdWISRwtQOkOCp9MQCkjgX+Z3xKFMpPWC/56WFWip5Wrthf9ZDd57FdIthH07Onr0EanY6M7yHSpZ6fFWcycnLAoU2SiYrbgKjW+WSTzi9MwqGLGhGUtJ9U6pgBWQFUINfHR53VFeYqwcP+BXOkYjKuHPHbF4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786560667; c=relaxed/simple; bh=Pt9qfV+VZrzOMrXkfDixZovAdJURxtZTHOeWcDWULvw=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=pQNcL6SLB3nDO20zzD2RBmpVYTA3kHhxNWJdVv45h8MQXamX9zmzyZbc8Kl+6Emd622a4YbXf+v6M47s5WdV0Jrw8pClDAGMkmuNTPW7ht+xT+KPma0tMFG+0EMMi25ugQJ18qZzEAtCeKAZM1etkCKCW7uBrmJjeKnoWaUGBdk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QQsb9/vK; arc=none smtp.client-ip=209.85.221.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QQsb9/vK" Received: by mail-wr1-f47.google.com with SMTP id ffacd0b85a97d-480033bdcf4so760383f8f.2 for ; Wed, 12 Aug 2026 11:51:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786560664; x=1787165464; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=u1mefYIOiMLZeO91w9ATRUkuvXI2RGubrhxyQj9n/Fk=; b=QQsb9/vKZH1KoLat41ua0v0QpganrTenZLl6xZihVZ+sZlQcHgRwPMhz4nflKsctvj g3aGAdQvswvyNc4El5x3ky32drCXdVhn12AgB8J1bAr8Pkm1K1eBnqikJO9E0RQZh0ed fQmB2uD1XFWIUoMITnBfPFOH8BMT4MVmYTCnrL5mkXjP6vAag6vv8HKmDDAAjZ1y4S5u M4ZJKQ5lWspLZ/vgpvGA6Uf3gUQo8n4MaBwUL5wYwDpzz3z9hpPxY6J3WMRrZlDkhkOe /Zc+v0PHiCmJ5Ve3AQ1XFJoJG2O11ecNKg6eZrnm6AwY2pAEWSSxdzORZVLM8Eo5KJQ/ OHYA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786560664; x=1787165464; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=u1mefYIOiMLZeO91w9ATRUkuvXI2RGubrhxyQj9n/Fk=; b=qglS87LAnGDWMNauG+Fe/QofPDLdeCW2OcOPiSWLR5SCKXuQaU239349VaqFRSAUyR Cb3lK/ge+iX2lEu9cz8kRhWc7+Wqxf95c8HuuhLK9DEwhCJz+oVhCOjED6hXOo9nouU1 Mw1gqKSMy67f4OU+gzCQcFlvjRBPw/+lY4x35aNpNF6hx+kzFx/uLz9rZOG7rCLFS4f+ VEv62aAxf8XciiI8Vrxy9A8xgqhIeCYaqJGhjiPG/wmQJSJyzThItXH2fWZbkTTq2utO tkfMes+hgXNkFrkPi4M1g4iERE/swOw8Fkhmx46DvOjHPBmWQ3O69eJZnNoBtYN+J70c wsiA== X-Forwarded-Encrypted: i=1; AHgh+Rohvh0U8MGpIRHaNpt7f/PNR3DCfK/vQUPGQL82t44TfIoeAnKI21o5FqeKuxlKSGgDkFbzGou4vO+AivQ=@vger.kernel.org X-Gm-Message-State: AOJu0YxU4/vm7SNkO1c1KYT5O/BzsziSCRblESZu09CDo3S+imh96u1X IcS9J0vMDolLI2IBHwBdjIE1F3RgGtq6HOvAlleumOY1juZuIXq7/P3D X-Gm-Gg: AR+sD12w1xb+m6lOL5qzfciTfiAKQpm1zv/D5O728KHdg7mjy2jkU+CBqlv/GSefPIz FenNFdYpTH9naCjYquCLMbUphZmUO7uJX4R1MyncZ3C104gpZ0ZD7ziGiDB3Kp8Bq/vlLbvdvKr i69LD9DAoCs3VOCKTTi/as6hXBcedtqFvg6IPmulaiCVPwrqIxfANH8iq6Ng/6ltfQMmsZmGHlO l74TGrbRBldxSVPXLuWhWIl1CPYiDnPgdtcp0Ji5ARNcMRj7jBFNHqjBF7xIuSHolq887e2Shik NZTN7eAlt/Q01PNcBk4yW103lxq6V2YsH1Lt0X60rEeY9lH6i8woktzzo8JvTWUag1U9k4KWftb 8+iiUOfqWg11iN/MgQDDCANW45qGyDE4YEs4+APSueKw1sJ87VJklHNnCHg1QTw0P4Nug6Ov1Ax xIzy/sHKkrnrEDPPvfuKlvOaMdLb+xrIM0q7KhTZH70LUXBtCmcATGWY4i4YpbwdswEPBSRhjYQ avKyR1yrzNLiYK7Y3ORunYxB2PwGYdxymKLN9J79F/dMxgsjJni7/6pwbT7bp0bJgKTUfcQXkbw DxR9MZAgYAiIzX8bFSsRjG0xKngahNp/8YCdwc2p8LgIdDHClZjB946HjAbtZr/dAyJO X-Received: by 2002:a05:6000:41d8:b0:47f:91e3:3cbf with SMTP id ffacd0b85a97d-4815a01c520mr318407f8f.19.1786560663566; Wed, 12 Aug 2026 11:51:03 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-a869-c801-382b-4199-5518-da16.310.pool.telefonica.de. [2a02:3100:a869:c801:382b:4199:5518:da16]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-48150c088c9sm9658029f8f.13.2026.08.12.11.51.02 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Wed, 12 Aug 2026 11:51:03 -0700 (PDT) From: Karl Mehltretter To: Russell King Cc: Karl Mehltretter , Xie Yuanbin , Ard Biesheuvel , Linus Walleij , Robin Murphy , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [PATCH RESEND] ARM: alignment: fix LSR #32 and ASR #32 offset decoding Date: Wed, 12 Aug 2026 20:50:57 +0200 Message-Id: <20260812185057.1573-1-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The register-offset form of LDR/STR may apply a shift to Rm. Per DecodeImmShift() (ARM ARM DDI0406C section A8.4.3, "Pseudocode details of instruction-specified shifts and rotates"), an imm5 of 0 encodes a shift of 32 for LSR and ASR; only LSL treats 0 as "no shift", and ROR with 0 encodes RRX. do_alignment() special-cases RRX but not LSR or ASR, and IS_SHIFT() does not filter these encodings out, so the block is entered with shiftval =3D=3D 0 and the offset becomes Rm instead of 0 (LSR #32) or the replicated sign of Rm (ASR #32). do_alignment_finish_ldst() applies the offset to the base-register writeback of the post-indexed form, so the emulated access itself uses the correct faulting address but Rn is left holding the wrong value. Reproduced on ARM926EJ-S (versatile_defconfig, CONFIG_ALIGNMENT_TRAP=3Dy, gcc 13.3.0) with a misaligned base and Rm =3D 0x1000: ldr r0, [r1], r2, lsr #32 Rn advanced by 0x1000, must be unchanged ldr r0, [r1], r2, asr #32 Rn advanced by 0x1000, must be unchanged ldr r0, [r1], r2, asr #32 with Rm negative, Rn must decrease by 1 All three are correct with the patch applied, while a lsr #1 control case is emulated correctly both before and after. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter Reviewed-by: Linus Walleij --- Resending after two weeks without feedback; add ARM alignment reviewers to Cc. arch/arm/mm/alignment.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c index 812380f30ae3..49045e09ae18 100644 --- a/arch/arm/mm/alignment.c +++ b/arch/arm/mm/alignment.c @@ -892,11 +892,17 @@ do_alignment(unsigned long addr, unsigned int fsr, st= ruct pt_regs *regs) break; =20 case SHIFT_LSR: - offset.un >>=3D shiftval; + if (shiftval =3D=3D 0) + offset.un =3D 0; + else + offset.un >>=3D shiftval; break; =20 case SHIFT_ASR: - offset.sn >>=3D shiftval; + if (shiftval =3D=3D 0) + offset.sn >>=3D 31; + else + offset.sn >>=3D shiftval; break; =20 case SHIFT_RORRRX: --=20 2.39.5 (Apple Git-154)