[PATCH] x86/lib: make clean_cache_range() zero-size safe

[PATCH] x86/lib: make clean_cache_range() zero-size safe

[Li Zhe]

clean_cache_range() writes back each cache line in the range
[addr, addr + size). A zero-size range is empty and should not perform
any cache maintenance operation.

As pointed out by Sashiko [1], clean_cache_range(addr, 0) currently can
still execute one CLWB when addr is not cache-line aligned. With size 0,
vend is equal to addr. However, the loop starts from the
cacheline-aligned address containing addr. If addr is not cacheline
aligned, that rounded-down start is below vend, so the loop can execute
one CLWB even though the requested range is empty.

That gives zero-size callers observable side effects. For example,
arch_wb_cache_pmem(addr, 0) should not write back any cache line, and
memcpy_flushcache(dst, src, 0) should preserve the usual zero-length
copy semantics. If the rounded-down line is not mapped, the stray CLWB
can also fault.

Return immediately from clean_cache_range() for size 0.

[1] https://sashiko.dev/#/patchset/20260831111638.76012-1-lizhe.67@bytedance.com

Signed-off-by: Li Zhe <lizhe.67@bytedance.com>
---
 arch/x86/lib/usercopy_64.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/lib/usercopy_64.c b/arch/x86/lib/usercopy_64.c
index c47d8cd0e243..5adf772cbf04 100644
--- a/arch/x86/lib/usercopy_64.c
+++ b/arch/x86/lib/usercopy_64.c
@@ -32,6 +32,9 @@ static void clean_cache_range(void *addr, size_t size)
 	void *vend = addr + size;
 	void *p;
 
+	if (!size)
+		return;
+
 	for (p = (void *)((unsigned long)addr & ~clflush_mask);
 	     p < vend; p += x86_clflush_size)
 		clwb(p);
-- 
2.20.1

Re: [PATCH] x86/lib: make clean_cache_range() zero-size safe

[Andrew Morton]

On Thu,  3 Sep 2026 15:11:25 +0800 "Li Zhe" <lizhe.67@bytedance.com> wrote:

> clean_cache_range() writes back each cache line in the range
> [addr, addr + size). A zero-size range is empty and should not perform
> any cache maintenance operation.
> 
> As pointed out by Sashiko [1], clean_cache_range(addr, 0) currently can
> still execute one CLWB when addr is not cache-line aligned. With size 0,
> vend is equal to addr. However, the loop starts from the
> cacheline-aligned address containing addr. If addr is not cacheline
> aligned, that rounded-down start is below vend, so the loop can execute
> one CLWB even though the requested range is empty.
> 
> That gives zero-size callers observable side effects. For example,
> arch_wb_cache_pmem(addr, 0) should not write back any cache line, and
> memcpy_flushcache(dst, src, 0) should preserve the usual zero-length
> copy semantics. If the rounded-down line is not mapped, the stray CLWB
> can also fault.
> 
> Return immediately from clean_cache_range() for size 0.

Thanks.  Sashiko might have found a few similar issues in there:
	https://sashiko.dev/#/patchset/20260903071125.1946-1-lizhe.67@bytedance.com

Re: [PATCH] x86/lib: make clean_cache_range() zero-size safe

[Li Zhe]

On 9/4/26 12:29 AM, Andrew Morton wrote:
> On Thu,  3 Sep 2026 15:11:25 +0800 "Li Zhe" <lizhe.67@bytedance.com> wrote:
>
>> clean_cache_range() writes back each cache line in the range
>> [addr, addr + size). A zero-size range is empty and should not perform
>> any cache maintenance operation.
>>
>> As pointed out by Sashiko [1], clean_cache_range(addr, 0) currently can
>> still execute one CLWB when addr is not cache-line aligned. With size 0,
>> vend is equal to addr. However, the loop starts from the
>> cacheline-aligned address containing addr. If addr is not cacheline
>> aligned, that rounded-down start is below vend, so the loop can execute
>> one CLWB even though the requested range is empty.
>>
>> That gives zero-size callers observable side effects. For example,
>> arch_wb_cache_pmem(addr, 0) should not write back any cache line, and
>> memcpy_flushcache(dst, src, 0) should preserve the usual zero-length
>> copy semantics. If the rounded-down line is not mapped, the stray CLWB
>> can also fault.
>>
>> Return immediately from clean_cache_range() for size 0.
> Thanks.  Sashiko might have found a few similar issues in there:
> 	https://sashiko.dev/#/patchset/20260903071125.1946-1-lizhe.67@bytedance.com
Thanks for pointing this out.

I had a quick look. These comments appear to point at related
pre-existing corner cases in cache flush helpers, and one of them also
touches the DRM cache flushing helper. They are independent from the
specific clean_cache_range() issue fixed by this patch.

Would it make sense to keep this patch focused on clean_cache_range() for
now, and handle any additional cases separately if maintainers think they
should be fixed as well?

Thanks,
Zhe

Re: [PATCH] x86/lib: make clean_cache_range() zero-size safe

[Andrew Morton]

On Fri, 4 Sep 2026 15:54:08 +0800 "Li Zhe" <lizhe.67@bytedance.com> wrote:

> On 9/4/26 12:29 AM, Andrew Morton wrote:
> > On Thu,  3 Sep 2026 15:11:25 +0800 "Li Zhe" <lizhe.67@bytedance.com> wrote:
> >
> >> clean_cache_range() writes back each cache line in the range
> >> [addr, addr + size). A zero-size range is empty and should not perform
> >> any cache maintenance operation.
> >>
> >> As pointed out by Sashiko [1], clean_cache_range(addr, 0) currently can
> >> still execute one CLWB when addr is not cache-line aligned. With size 0,
> >> vend is equal to addr. However, the loop starts from the
> >> cacheline-aligned address containing addr. If addr is not cacheline
> >> aligned, that rounded-down start is below vend, so the loop can execute
> >> one CLWB even though the requested range is empty.
> >>
> >> That gives zero-size callers observable side effects. For example,
> >> arch_wb_cache_pmem(addr, 0) should not write back any cache line, and
> >> memcpy_flushcache(dst, src, 0) should preserve the usual zero-length
> >> copy semantics. If the rounded-down line is not mapped, the stray CLWB
> >> can also fault.
> >>
> >> Return immediately from clean_cache_range() for size 0.
> > Thanks.  Sashiko might have found a few similar issues in there:
> > 	https://sashiko.dev/#/patchset/20260903071125.1946-1-lizhe.67@bytedance.com
> Thanks for pointing this out.
> 
> I had a quick look. These comments appear to point at related
> pre-existing corner cases in cache flush helpers, and one of them also
> touches the DRM cache flushing helper. They are independent from the
> specific clean_cache_range() issue fixed by this patch.

Yup.

> Would it make sense to keep this patch focused on clean_cache_range() for
> now, 

I think so.  You're under no obligation to fix any Sashiko bugs!  But I
do like to point these things out because you might consider them
relevant to the patch under discussion.  

> and handle any additional cases separately if maintainers think they
> should be fixed as well?

That's up to the x86 team.