The compat alignment emulator inherited unsigned long data addresses from
the 32-bit ARM implementation.

In do_alignment_ldmstm(), nr_regs is an unsigned int holding the transfer
size. The function uses the same address addition for both transfer
directions, negating nr_regs first for a decrementing LDM or STM. The
32-bit negation wraps before the addition, so the handler adds nearly
4 GiB instead of subtracting the transfer size.
The resulting address lies outside the compat task's address space, so
decrementing LDM/STM emulation fails, while incrementing forms work.

For example, a backwards-moving copy routine using decrementing LDM/STM can
take an alignment fault when called with unaligned pointers. The compat
handler should emulate the transfer, but this bug instead causes SIGBUS.

The offset negated in do_alignment_finish_ldst() is offset_union.un, which
is already unsigned long and does not have this width mismatch.

Make nr_regs unsigned long so its negation and the address arithmetic
use the same width.

Fixes: 3fc24ef32d3b ("arm64: compat: Implement misalignment fixups for multiword loads")
Cc: stable@vger.kernel.org
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Changes in v2:
  - Narrow the fix to nr_regs, leaving the address types unchanged (Arnd).
  - Leave 32-bit address-space wraparound out of scope.
  - Add Cc: stable@vger.kernel.org now that the fix is narrowly scoped.

v1: https://lore.kernel.org/r/20260817000231.21311-1-kmehltretter@gmail.com

Tested:
  An AArch32 reproducer was run under QEMU and on a Raspberry Pi 400
  (Cortex-A72). An unaligned decrementing LDM gets SIGBUS with the baseline
  kernel and passes with v2 in both environments.

 arch/arm64/kernel/compat_alignment.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kernel/compat_alignment.c b/arch/arm64/kernel/compat_alignment.c
index b68e1d3..9b58d0a 100644
--- a/arch/arm64/kernel/compat_alignment.c
+++ b/arch/arm64/kernel/compat_alignment.c
@@ -114,8 +114,8 @@ do_alignment_ldrdstrd(unsigned long addr, u32 instr, struct pt_regs *regs)
 static int
 do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
 {
-	unsigned int rd, rn, nr_regs, regbits;
-	unsigned long eaddr, newaddr;
+	unsigned int rd, rn, regbits;
+	unsigned long eaddr, newaddr, nr_regs;
 	unsigned int val;
 
 	/* count the number of registers in the mask to be transferred */
-- 
2.39.5 (Apple Git-154)

On Thu, 20 Aug 2026 00:27:12 +0200, Karl Mehltretter wrote:
> The compat alignment emulator inherited unsigned long data addresses from
> the 32-bit ARM implementation.
> 
> In do_alignment_ldmstm(), nr_regs is an unsigned int holding the transfer
> size. The function uses the same address addition for both transfer
> directions, negating nr_regs first for a decrementing LDM or STM. The
> 32-bit negation wraps before the addition, so the handler adds nearly
> 4 GiB instead of subtracting the transfer size.
> The resulting address lies outside the compat task's address space, so
> decrementing LDM/STM emulation fails, while incrementing forms work.
> 
> [...]

Applied to arm64 (for-next/core), thanks!

[1/1] arm64: compat: Fix decrementing LDM/STM alignment emulation
      https://git.kernel.org/arm64/c/f5b8b9037df3

Cheers,
-- 
Will

https://fixes.arm64.dev
https://next.arm64.dev
https://will.arm64.dev