The function do_alignment can handle misaligned address for user and
kernel space. If it is a userspace access, do_alignment may fail on
a low-memory situation, because page faults are disabled in
probe_kernel_address.
Fix this by using __copy_from_user stead of probe_kernel_address.
Fixes: b255188 ("ARM: fix scheduling while atomic warning in alignment handling
code")
Signed-off-by: Jing Xiangfeng <jingxiangf...@huawei.com>
---
arch/arm/mm/alignment.c | 16 +++++++++++++---
1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/arch/arm/mm/alignment.c b/arch/arm/mm/alignment.c
index 04b3643..2ccabd3 100644
--- a/arch/arm/mm/alignment.c
+++ b/arch/arm/mm/alignment.c
@@ -774,6 +774,7 @@ static ssize_t alignment_proc_write(struct file *file,
const char __user *buffer
unsigned long instr = 0, instrptr;
int (*handler)(unsigned long addr, unsigned long instr, struct pt_regs
*regs);
unsigned int type;
+ mm_segment_t fs;
unsigned int fault;
u16 tinstr = 0;
int isize = 4;
@@ -784,16 +785,22 @@ static ssize_t alignment_proc_write(struct file *file,
const char __user *buffer
instrptr = instruction_pointer(regs);
+ fs = get_fs();
+ set_fs(KERNEL_DS);
if (thumb_mode(regs)) {
u16 *ptr = (u16 *)(instrptr & ~1);
- fault = probe_kernel_address(ptr, tinstr);
+ fault = __copy_from_user(tinstr,
+ (__force const void __user *)ptr,
+ sizeof(tinstr));
tinstr = __mem_to_opcode_thumb16(tinstr);
if (!fault) {
if (cpu_architecture() >= CPU_ARCH_ARMv7 &&
IS_T32(tinstr)) {
/* Thumb-2 32-bit */
u16 tinst2 = 0;
- fault = probe_kernel_address(ptr + 1, tinst2);
+ fault = __copy_from_user(tinst2,
+ (__force const void __user
*)(ptr+1),
+ sizeof(tinst2));
tinst2 = __mem_to_opcode_thumb16(tinst2);
instr = __opcode_thumb32_compose(tinstr,
tinst2);
thumb2_32b = 1;
@@ -803,10 +810,13 @@ static ssize_t alignment_proc_write(struct file *file,
const char __user *buffer
}
}
} else {
- fault = probe_kernel_address((void *)instrptr, instr);
+ fault = __copy_from_user(instr,
+ (__force const void __user *)instrptr,
+ sizeof(instr));
instr = __mem_to_opcode_arm(instr);
}
+ set_fs(fs);
if (fault) {
type = TYPE_FAULT;
goto bad_or_fault;
--
1.8.3.1
