Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

riscv/uaccess: Use unsafe wrappers for ASM GOTO

ASM GOTO is miscompiled by GCC when it is used inside a auto cleanup scope:

bool foo(u32 __user *p, u32 val)
{
scoped_guard(pagefault)
unsafe_put_user(val, p, efault);
return true;
efault:
return false;
}

It ends up leaking the pagefault disable counter in the fault path. clang
at least fails the build.

Rename unsafe_*_user() to arch_unsafe_*_user() which makes the generic
uaccess header wrap it with a local label that makes both compilers emit
correct code. Same for the kernel_nofault() variants.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://patch.msgid.link/20251027083745.419351819@linutronix.de

authored by

Thomas Gleixner and committed by
Peter Zijlstra
0988ea18 5002dd53

+4 -4
+4 -4
arch/riscv/include/asm/uaccess.h
··· 437 437 __clear_user(untagged_addr(to), n) : n; 438 438 } 439 439 440 - #define __get_kernel_nofault(dst, src, type, err_label) \ 440 + #define arch_get_kernel_nofault(dst, src, type, err_label) \ 441 441 __get_user_nocheck(*((type *)(dst)), (__force __user type *)(src), err_label) 442 442 443 - #define __put_kernel_nofault(dst, src, type, err_label) \ 443 + #define arch_put_kernel_nofault(dst, src, type, err_label) \ 444 444 __put_user_nocheck(*((type *)(src)), (__force __user type *)(dst), err_label) 445 445 446 446 static __must_check __always_inline bool user_access_begin(const void __user *ptr, size_t len) ··· 460 460 * We want the unsafe accessors to always be inlined and use 461 461 * the error labels - thus the macro games. 462 462 */ 463 - #define unsafe_put_user(x, ptr, label) \ 463 + #define arch_unsafe_put_user(x, ptr, label) \ 464 464 __put_user_nocheck(x, (ptr), label) 465 465 466 - #define unsafe_get_user(x, ptr, label) do { \ 466 + #define arch_unsafe_get_user(x, ptr, label) do { \ 467 467 __inttype(*(ptr)) __gu_val; \ 468 468 __get_user_nocheck(__gu_val, (ptr), label); \ 469 469 (x) = (__force __typeof__(*(ptr)))__gu_val; \