From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B550D37AA9A for ; Sat, 13 Jun 2026 12:27:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781353649; cv=none; b=FMXildiELNmxa42wA8wcH9ien4jq7dHdXKcHSzu4ur5DbmtKyNrQ/XAA7lvQ0d1hPAMTAcKl1Ui3sPLO9sDifJ7e/BENjzMn3ETpjwJemnYKW9mf9u+lz+XEDzBCgwxYBAf8H1g1gGWewrlGzpw3ieqEYNWju+LDkfiQ5qsODgA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781353649; c=relaxed/simple; bh=cIMr8KAG1n5gJS4v6YrVZy/ezUm0NdhdnsBLGiy5GGE=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=LB6A7CO7+C0kDeVqQyiLU7GsvKFeVkq5XooOSldCthc7jQ8NS8SKg0WH3zu3HGzUpy6B51Ud6dfUEOB5krBJ1oeD2zXPSfoF/l6nkJPLD8USNtxpHoCzdTiG2kBJXOelqFOZHx6MNs8w0RCwSKW0eRv8nLMPg9N8bOaPevS/XI4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cwiggPfI; arc=none smtp.client-ip=209.85.128.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cwiggPfI" Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-490b3637b90so13693585e9.3 for ; Sat, 13 Jun 2026 05:27:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781353645; x=1781958445; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=HiF5drf3rvuABmv6sPErXIP4rKLg0zCEPYPnEhOmOzg=; b=cwiggPfIJb2l3L5rYQC+U/wRK5FFzqgbPannXK00qEKO0tKZjZPkfsbSJztyfRN8iP IdaX250WUPotQG01E+mFycUi+nQ59c00NTBBVQnMVrJ085eLL3kXJP4+JhIfMU0FV4Pu mDesoq11m8OATxNp78zk7hGF6pl1/SIYBGjj2Nsw0eJKp0N/6DFQQ/1lhOkSGKafxcSl qJrPM5TYF6jZTv2o1KfToCXYXxGNJKmMI7FH8SR3uBWKL8mwmND00sC9EKc73Kw9iz5p 0Wuum/mVasLNYn1SdZY4GVVc943uljK4YRANbkbQprBUykMApkEJEhhzU2M+cv6aRmra 2ARA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781353645; x=1781958445; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=HiF5drf3rvuABmv6sPErXIP4rKLg0zCEPYPnEhOmOzg=; b=SVytjR0fM5I1fSVmYykG1EI61iHeEFKlU6UnuqzFvrnRu2n7oJPxtv9jvtr/H7GprU nt7fXhCl6YU+jlEnWbGBD6H6yk5KRv7AswcB3isFLyYII5d8WcY4zcqeQPetJ8exHki9 DK29CQljvEVRV0+XOBHFpBIm1ku+EM/Mz/B6z36biyMBvzfwUvYQv8v9mJtoIEo7sHY6 gpAQ9SQ6cZn6nQG+jpn0ViBjVppyw7fw/8F8IxoDOddMQVTwD37OYlR21ertbh0yrD3k RN8pVXU78thRvxGJs8QZOHOk/36nDsBgvm3vHd+e4gJT1h3SuL2lOc5Cag6gqUH0k6LH J6gQ== X-Forwarded-Encrypted: i=1; AFNElJ/DeEqYrQn+mYcfxtZU6e47hWeE09VlQuN/9gof+wsSvy8MCr+H4PlaTIxubx3uo1K3YempoyZN59niud4=@vger.kernel.org X-Gm-Message-State: AOJu0YxZK/abyeEbPtES6OGq8MQK6Vf3bQvxDQ9FnLz/UqNXKhueL6QK eROtPTFEO5pveh3zc1MY2CIGtzk2otrD4ZkovjEAZoYW6/ri/wUKgF+L X-Gm-Gg: Acq92OGJF2+BHYVa1VpiGeaYKSj30Zetbw2dzjtwA7n2nmhUQKTAz7ywLOcKX4CnZIc KUiKklA6ny5hgrpt64O4CstMcsT63PlAM1rmYaECSdCpGDwrl52KRxf4Gd++aLcAO5dUNA2G89M 12CZJzDubYI5Wd/3szFHrQgGRrI/G+bVL/ekkToBuhidkWefFfczSVAZJEoCcUtWDPLlPMnAzXX AvCtNUT4HTy5KOCRwSKlzzv8Vej4ZHFBrC59DBqjPw9osN54UH0TiF8+GZJ54vN2FmrPEIV4Os5 uw6kla69k5jtWfOSvzHk6ru3YMS3sFs5rIKftA2V4XEr0LrIQ+81E6xfwz8C4vj8ssC/m0NWo95 7O/WpWMb2k0m2LOIVSjI2H+VQDPvZDVTR8BKK9oJlaob/EUoclcg5er1aF6ExAKUmpQ1CLI+wfj 982D/jUeR6d56ex8E= X-Received: by 2002:a05:600c:3e06:b0:490:a964:14f8 with SMTP id 5b1f17b1804b1-49220084947mr40343985e9.8.1781353644739; Sat, 13 Jun 2026 05:27:24 -0700 (PDT) Received: from debian.. ([185.3.146.53]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-492202edf89sm76465685e9.1.2026.06.13.05.27.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 13 Jun 2026 05:27:24 -0700 (PDT) From: Tal Well To: linux@armlinux.org.uk Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Tal Well Subject: [PATCH] ARM: Fix potential register clobbering in __get_user_check Date: Sat, 13 Jun 2026 15:27:07 +0300 Message-Id: <20260613122707.512353-1-talwell02@gmail.com> X-Mailer: git-send-email 2.39.5 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit This can happen due to local variable registers being call-clobbered by uaccess_save_and_enable or uaccess_restore, which can happen if they become slightly more complicated than they are (for example contain any memory access while KASAN is enabled). In that case, the first user access will fail while trying to execute the init process and the kernel will panic. While this is not strictly a bug given r0, r1 and r2 remain unused in the uaccess functions, even something as simple as making them noinline breaks this assumption and there's no reason to rely on it. This is similar to the issue fixed by commit df909df0770779f1a556 ("ARM: 9132/1: Fix __get_user_check failure with ARM KASAN images"), but that only handled clobbering of r0 by the uaccess_restore function. Signed-off-by: Tal Well --- arch/arm/include/asm/uaccess.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/arch/arm/include/asm/uaccess.h b/arch/arm/include/asm/uaccess.h index d6ae80b5df36..290ce8710773 100644 --- a/arch/arm/include/asm/uaccess.h +++ b/arch/arm/include/asm/uaccess.h @@ -180,12 +180,13 @@ extern int __get_user_64t_4(void *); #define __get_user_check(x, p) \ ({ \ - unsigned long __limit = TASK_SIZE - 1; \ + unsigned long __limit = TASK_SIZE - 1; \ + unsigned int __ua_flags = uaccess_save_and_enable(); \ register typeof(*(p)) __user *__p asm("r0") = (p); \ register __inttype(x) __r2 asm("r2"); \ register unsigned long __l asm("r1") = __limit; \ register int __e asm("r0"); \ - unsigned int __ua_flags = uaccess_save_and_enable(); \ + __inttype(x) __tmp_r2; \ int __tmp_e; \ switch (sizeof(*(__p))) { \ case 1: \ @@ -214,9 +215,10 @@ extern int __get_user_64t_4(void *); break; \ default: __e = __get_user_bad(); break; \ } \ + __tmp_r2 = __r2; \ __tmp_e = __e; \ uaccess_restore(__ua_flags); \ - x = (typeof(*(p))) __r2; \ + x = (typeof(*(p))) __tmp_r2; \ __tmp_e; \ }) base-commit: 062871f1371b2e02a272ff5279c6479aff0a37ef -- 2.39.5