[PATCH v2] x86/fpu: Use vmemdup_user() in xstateregs_set()

From: Thorsten Blum

Date: Wed Aug 05 2026 - 10:04:53 EST


Replace the open-coded vmalloc() and copy_from_user() with
vmemdup_user() to simplify xstateregs_set().

vmemdup_user() returns an ERR_PTR() on failure, preserving the existing
-ENOMEM and -EFAULT error codes. Since vmemdup_user() is backed by
kvmalloc(), use kvfree() to free the buffer instead.

Return early on error and drop the obsolete out label.

Performance should be similar, and xstateregs_set() is not a hot path.
Page alignment should not matter because the buffer is only used as a
memcpy() source in copy_uabi_from_kernel_to_xstate().

The allocation behavior differs because vmemdup_user() uses GFP_USER,
which adds __GFP_HARDWALL and may affect cpuset allocations.

tools/testing/selftests/x86/avx_64 passed on an Alder Lake CPU.

Signed-off-by: Thorsten Blum <thorsten.blum@xxxxxxxxx>
---
Changes in v2:
- Add performance analysis and selftest result to the changelog (Ingo)
- v1: https://lore.kernel.org/r/20260720195534.70111-3-thorsten.blum@xxxxxxxxx/
---
arch/x86/kernel/fpu/regset.c | 17 ++++++-----------
1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c
index 0986c2200adc..8dc9de732c78 100644
--- a/arch/x86/kernel/fpu/regset.c
+++ b/arch/x86/kernel/fpu/regset.c
@@ -3,7 +3,8 @@
* FPU register's regset abstraction, for ptrace, core dumps, etc.
*/
#include <linux/sched/task_stack.h>
-#include <linux/vmalloc.h>
+#include <linux/slab.h>
+#include <linux/string.h>

#include <asm/fpu/api.h>
#include <asm/fpu/signal.h>
@@ -157,21 +158,15 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset,
return -EFAULT;

if (!kbuf) {
- tmpbuf = vmalloc(count);
- if (!tmpbuf)
- return -ENOMEM;
-
- if (copy_from_user(tmpbuf, ubuf, count)) {
- ret = -EFAULT;
- goto out;
- }
+ tmpbuf = vmemdup_user(ubuf, count);
+ if (IS_ERR(tmpbuf))
+ return PTR_ERR(tmpbuf);
}

fpu_force_restore(fpu);
ret = copy_uabi_from_kernel_to_xstate(fpu->fpstate, kbuf ?: tmpbuf, &target->thread.pkru);

-out:
- vfree(tmpbuf);
+ kvfree(tmpbuf);
return ret;
}