[PATCH] sh: traps: Fix kernel unaligned access fixup in branch delay slots

[PATCH] sh: traps: Fix kernel unaligned access fixup in branch delay slots

[Florian Fuchs]

Commit 75d4d29549e5 ("sh: remove CONFIG_SET_FS support") converted the
callers' set_fs(KERNEL_DS) sections, but missed copy_from_user() in
handle_delayslot() which relied on the caller's address limit. This also
broke delay slot instruction fetching through handle_trapped_io().

Since the removal of set_fs(), access_ok() rejects kernel addresses, so
the fetch always fails for kernel code and the kernel dies with:

  delay-slot-insn faulting in handle_unaligned_delayslot: 0000 [#1]

The initial instruction fetch in do_address_error() already uses
copy_from_kernel_nofault() for kernel mode. So choose the matching
instruction-fetch accessor from user_mode(regs) and fetch the
instruction.

Fixes: 75d4d29549e5 ("sh: remove CONFIG_SET_FS support")
Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
---
The issue was hit while using PPP with VJ header compression, where gcc
placed an unaligned checksum store in slhc_compress() into the delay
slot, which panicked the system e.g. using ssh over this line.

 arch/sh/kernel/traps_32.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/sh/kernel/traps_32.c b/arch/sh/kernel/traps_32.c
index 1271b839a107..a7f20fead5f4 100644
--- a/arch/sh/kernel/traps_32.c
+++ b/arch/sh/kernel/traps_32.c
@@ -287,8 +287,10 @@ static inline int handle_delayslot(struct pt_regs *regs,
 	insn_size_t instruction;
 	void __user *addr = (void __user *)(regs->pc +
 		instruction_size(old_instruction));
+	struct mem_access *insn_ma = user_mode(regs) ?
+		&user_mem_access : &kernel_mem_access;
 
-	if (copy_from_user(&instruction, addr, sizeof(instruction))) {
+	if (insn_ma->from(&instruction, addr, sizeof(instruction))) {
 		/* the instruction-fetch faulted */
 		if (user_mode(regs))
 			return -EFAULT;

base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
-- 
2.43.0