[PATCH] sh: traps: Fix kernel unaligned access fixup in branch delay slots

[PATCH] sh: traps: Fix kernel unaligned access fixup in branch delay slots

[Florian Fuchs]

Commit 75d4d29549e5 ("sh: remove CONFIG_SET_FS support") converted the
callers' set_fs(KERNEL_DS) sections, but missed copy_from_user() in
handle_delayslot() which relied on the caller's address limit. This also
broke delay slot instruction fetching through handle_trapped_io().

Since the removal of set_fs(), access_ok() rejects kernel addresses, so
the fetch always fails for kernel code and the kernel dies with:

  delay-slot-insn faulting in handle_unaligned_delayslot: 0000 [#1]

The initial instruction fetch in do_address_error() already uses
copy_from_kernel_nofault() for kernel mode. So choose the matching
instruction-fetch accessor from user_mode(regs) and fetch the
instruction.

Fixes: 75d4d29549e5 ("sh: remove CONFIG_SET_FS support")
Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
---
The issue was hit while using PPP with VJ header compression, where gcc
placed an unaligned checksum store in slhc_compress() into the delay
slot, which panicked the system e.g. using ssh over this line.

 arch/sh/kernel/traps_32.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/arch/sh/kernel/traps_32.c b/arch/sh/kernel/traps_32.c
index 1271b839a107..a7f20fead5f4 100644
--- a/arch/sh/kernel/traps_32.c
+++ b/arch/sh/kernel/traps_32.c
@@ -287,8 +287,10 @@ static inline int handle_delayslot(struct pt_regs *regs,
 	insn_size_t instruction;
 	void __user *addr = (void __user *)(regs->pc +
 		instruction_size(old_instruction));
+	struct mem_access *insn_ma = user_mode(regs) ?
+		&user_mem_access : &kernel_mem_access;
 
-	if (copy_from_user(&instruction, addr, sizeof(instruction))) {
+	if (insn_ma->from(&instruction, addr, sizeof(instruction))) {
 		/* the instruction-fetch faulted */
 		if (user_mode(regs))
 			return -EFAULT;

base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
-- 
2.43.0

Re: [PATCH] sh: traps: Fix kernel unaligned access fixup in branch delay slots

[Arnd Bergmann]

On Fri, Oct 23, 2026, at 01:34, Florian Fuchs wrote:
> Commit 75d4d29549e5 ("sh: remove CONFIG_SET_FS support") converted the
> callers' set_fs(KERNEL_DS) sections, but missed copy_from_user() in
> handle_delayslot() which relied on the caller's address limit. This also
> broke delay slot instruction fetching through handle_trapped_io().
>
> Since the removal of set_fs(), access_ok() rejects kernel addresses, so
> the fetch always fails for kernel code and the kernel dies with:
>
>   delay-slot-insn faulting in handle_unaligned_delayslot: 0000 [#1]
>
> The initial instruction fetch in do_address_error() already uses
> copy_from_kernel_nofault() for kernel mode. So choose the matching
> instruction-fetch accessor from user_mode(regs) and fetch the
> instruction.
>
> Fixes: 75d4d29549e5 ("sh: remove CONFIG_SET_FS support")
> Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>

Hi Florian,

The patch looks correct to me, but I find it a little confusing:

> @@ -287,8 +287,10 @@ static inline int handle_delayslot(struct pt_regs *regs,
>  	insn_size_t instruction;
>  	void __user *addr = (void __user *)(regs->pc +
>  		instruction_size(old_instruction));
> +	struct mem_access *insn_ma = user_mode(regs) ?
> +		&user_mem_access : &kernel_mem_access;
> 
> -	if (copy_from_user(&instruction, addr, sizeof(instruction))) {
> +	if (insn_ma->from(&instruction, addr, sizeof(instruction))) {
>  		/* the instruction-fetch faulted */
>  		if (user_mode(regs))
>  			return -EFAULT;

The "insn_ma" pointer is always the same as the 'ma' argument
you already pass, as both are set based on 'user_mode(regs)'.
Why not just use the pointer you already have?

       Arnd

Re: [PATCH] sh: traps: Fix kernel unaligned access fixup in branch delay slots

[Geert Uytterhoeven]

Hi Arnd,

On Fri, 23 Oct 2026 at 09:09, Arnd Bergmann <arnd@arndb.de> wrote:
> On Fri, Oct 23, 2026, at 01:34, Florian Fuchs wrote:
> > Commit 75d4d29549e5 ("sh: remove CONFIG_SET_FS support") converted the
> > callers' set_fs(KERNEL_DS) sections, but missed copy_from_user() in
> > handle_delayslot() which relied on the caller's address limit. This also
> > broke delay slot instruction fetching through handle_trapped_io().
> >
> > Since the removal of set_fs(), access_ok() rejects kernel addresses, so
> > the fetch always fails for kernel code and the kernel dies with:
> >
> >   delay-slot-insn faulting in handle_unaligned_delayslot: 0000 [#1]
> >
> > The initial instruction fetch in do_address_error() already uses
> > copy_from_kernel_nofault() for kernel mode. So choose the matching
> > instruction-fetch accessor from user_mode(regs) and fetch the
> > instruction.
> >
> > Fixes: 75d4d29549e5 ("sh: remove CONFIG_SET_FS support")
> > Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
>
> Hi Florian,
>
> The patch looks correct to me, but I find it a little confusing:
>
> > @@ -287,8 +287,10 @@ static inline int handle_delayslot(struct pt_regs *regs,
> >       insn_size_t instruction;
> >       void __user *addr = (void __user *)(regs->pc +
> >               instruction_size(old_instruction));
> > +     struct mem_access *insn_ma = user_mode(regs) ?
> > +             &user_mem_access : &kernel_mem_access;
> >
> > -     if (copy_from_user(&instruction, addr, sizeof(instruction))) {
> > +     if (insn_ma->from(&instruction, addr, sizeof(instruction))) {
> >               /* the instruction-fetch faulted */
> >               if (user_mode(regs))
> >                       return -EFAULT;
>
> The "insn_ma" pointer is always the same as the 'ma' argument
> you already pass, as both are set based on 'user_mode(regs)'.
> Why not just use the pointer you already have?

That would also handle handle_trapped_io(), which passes
&trapped_io_access, right?

Gr{oetje,eeting}s,

                        Geert

-- 
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org

In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
                                -- Linus Torvalds

Re: [PATCH] sh: traps: Fix kernel unaligned access fixup in branch delay slots

[Arnd Bergmann]

On Fri, Oct 23, 2026, at 09:15, Geert Uytterhoeven wrote:
> On Fri, 23 Oct 2026 at 09:09, Arnd Bergmann <arnd@arndb.de> wrote:
>> On Fri, Oct 23, 2026, at 01:34, Florian Fuchs wrote:
>> > @@ -287,8 +287,10 @@ static inline int handle_delayslot(struct pt_regs *regs,
>> >       insn_size_t instruction;
>> >       void __user *addr = (void __user *)(regs->pc +
>> >               instruction_size(old_instruction));
>> > +     struct mem_access *insn_ma = user_mode(regs) ?
>> > +             &user_mem_access : &kernel_mem_access;
>> >
>> > -     if (copy_from_user(&instruction, addr, sizeof(instruction))) {
>> > +     if (insn_ma->from(&instruction, addr, sizeof(instruction))) {
>> >               /* the instruction-fetch faulted */
>> >               if (user_mode(regs))
>> >                       return -EFAULT;
>>
>> The "insn_ma" pointer is always the same as the 'ma' argument
>> you already pass, as both are set based on 'user_mode(regs)'.
>> Why not just use the pointer you already have?
>
> That would also handle handle_trapped_io(), which passes
> &trapped_io_access, right?

Indeed, that would be bad. The patch looks fine then.

Acked-by: Arnd Bergmann <arnd@arndb.de>