Re: [PATCH] sh: traps: Fix kernel unaligned access fixup in branch delay slots

[Arnd Bergmann]

On Fri, Oct 23, 2026, at 01:34, Florian Fuchs wrote:
> Commit 75d4d29549e5 ("sh: remove CONFIG_SET_FS support") converted the
> callers' set_fs(KERNEL_DS) sections, but missed copy_from_user() in
> handle_delayslot() which relied on the caller's address limit. This also
> broke delay slot instruction fetching through handle_trapped_io().
>
> Since the removal of set_fs(), access_ok() rejects kernel addresses, so
> the fetch always fails for kernel code and the kernel dies with:
>
>   delay-slot-insn faulting in handle_unaligned_delayslot: 0000 [#1]
>
> The initial instruction fetch in do_address_error() already uses
> copy_from_kernel_nofault() for kernel mode. So choose the matching
> instruction-fetch accessor from user_mode(regs) and fetch the
> instruction.
>
> Fixes: 75d4d29549e5 ("sh: remove CONFIG_SET_FS support")
> Signed-off-by: Florian Fuchs <fuchsfl@xxxxxxxxx>

Hi Florian,

The patch looks correct to me, but I find it a little confusing:

> @@ -287,8 +287,10 @@ static inline int handle_delayslot(struct pt_regs *regs,
>  	insn_size_t instruction;
>  	void __user *addr = (void __user *)(regs->pc +
>  		instruction_size(old_instruction));
> +	struct mem_access *insn_ma = user_mode(regs) ?
> +		&user_mem_access : &kernel_mem_access;
> 
> -	if (copy_from_user(&instruction, addr, sizeof(instruction))) {
> +	if (insn_ma->from(&instruction, addr, sizeof(instruction))) {
>  		/* the instruction-fetch faulted */
>  		if (user_mode(regs))
>  			return -EFAULT;

The "insn_ma" pointer is always the same as the 'ma' argument
you already pass, as both are set based on 'user_mode(regs)'.
Why not just use the pointer you already have?

       Arnd