Re: [PATCH] sh: traps: Fix kernel unaligned access fixup in branch delay slots

[Geert Uytterhoeven]

Hi Arnd,

On Fri, 23 Oct 2026 at 09:09, Arnd Bergmann <arnd@xxxxxxxx> wrote:
> On Fri, Oct 23, 2026, at 01:34, Florian Fuchs wrote:
> > Commit 75d4d29549e5 ("sh: remove CONFIG_SET_FS support") converted the
> > callers' set_fs(KERNEL_DS) sections, but missed copy_from_user() in
> > handle_delayslot() which relied on the caller's address limit. This also
> > broke delay slot instruction fetching through handle_trapped_io().
> >
> > Since the removal of set_fs(), access_ok() rejects kernel addresses, so
> > the fetch always fails for kernel code and the kernel dies with:
> >
> >   delay-slot-insn faulting in handle_unaligned_delayslot: 0000 [#1]
> >
> > The initial instruction fetch in do_address_error() already uses
> > copy_from_kernel_nofault() for kernel mode. So choose the matching
> > instruction-fetch accessor from user_mode(regs) and fetch the
> > instruction.
> >
> > Fixes: 75d4d29549e5 ("sh: remove CONFIG_SET_FS support")
> > Signed-off-by: Florian Fuchs <fuchsfl@xxxxxxxxx>
>
> Hi Florian,
>
> The patch looks correct to me, but I find it a little confusing:
>
> > @@ -287,8 +287,10 @@ static inline int handle_delayslot(struct pt_regs *regs,
> >       insn_size_t instruction;
> >       void __user *addr = (void __user *)(regs->pc +
> >               instruction_size(old_instruction));
> > +     struct mem_access *insn_ma = user_mode(regs) ?
> > +             &user_mem_access : &kernel_mem_access;
> >
> > -     if (copy_from_user(&instruction, addr, sizeof(instruction))) {
> > +     if (insn_ma->from(&instruction, addr, sizeof(instruction))) {
> >               /* the instruction-fetch faulted */
> >               if (user_mode(regs))
> >                       return -EFAULT;
>
> The "insn_ma" pointer is always the same as the 'ma' argument
> you already pass, as both are set based on 'user_mode(regs)'.
> Why not just use the pointer you already have?

That would also handle handle_trapped_io(), which passes
&trapped_io_access, right?

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@xxxxxxxxxxxxxx

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds