[PATCH v2] arm64: compat: Fix decrementing LDM/STM alignment emulation

[Karl Mehltretter]

The compat alignment emulator inherited unsigned long data addresses from
the 32-bit ARM implementation.

In do_alignment_ldmstm(), nr_regs is an unsigned int holding the transfer
size. The function uses the same address addition for both transfer
directions, negating nr_regs first for a decrementing LDM or STM. The
32-bit negation wraps before the addition, so the handler adds nearly
4 GiB instead of subtracting the transfer size.
The resulting address lies outside the compat task's address space, so
decrementing LDM/STM emulation fails, while incrementing forms work.

For example, a backwards-moving copy routine using decrementing LDM/STM can
take an alignment fault when called with unaligned pointers. The compat
handler should emulate the transfer, but this bug instead causes SIGBUS.

The offset negated in do_alignment_finish_ldst() is offset_union.un, which
is already unsigned long and does not have this width mismatch.

Make nr_regs unsigned long so its negation and the address arithmetic
use the same width.

Fixes: 3fc24ef32d3b ("arm64: compat: Implement misalignment fixups for multiword loads")
Cc: stable@xxxxxxxxxxxxxxx
Suggested-by: Arnd Bergmann <arnd@xxxxxxxx>
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>
---
Changes in v2:
  - Narrow the fix to nr_regs, leaving the address types unchanged (Arnd).
  - Leave 32-bit address-space wraparound out of scope.
  - Add Cc: stable@xxxxxxxxxxxxxxx now that the fix is narrowly scoped.

v1: https://lore.kernel.org/r/20260817000231.21311-1-kmehltretter@xxxxxxxxx

Tested:
  An AArch32 reproducer was run under QEMU and on a Raspberry Pi 400
  (Cortex-A72). An unaligned decrementing LDM gets SIGBUS with the baseline
  kernel and passes with v2 in both environments.

 arch/arm64/kernel/compat_alignment.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/arch/arm64/kernel/compat_alignment.c b/arch/arm64/kernel/compat_alignment.c
index b68e1d3..9b58d0a 100644
--- a/arch/arm64/kernel/compat_alignment.c
+++ b/arch/arm64/kernel/compat_alignment.c
@@ -114,8 +114,8 @@ do_alignment_ldrdstrd(unsigned long addr, u32 instr, struct pt_regs *regs)
 static int
 do_alignment_ldmstm(unsigned long addr, u32 instr, struct pt_regs *regs)
 {
-	unsigned int rd, rn, nr_regs, regbits;
-	unsigned long eaddr, newaddr;
+	unsigned int rd, rn, regbits;
+	unsigned long eaddr, newaddr, nr_regs;
 	unsigned int val;
 
 	/* count the number of registers in the mask to be transferred */
-- 
2.39.5 (Apple Git-154)