Merge tag 'fuse-fixes-5.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/mszer...

[linux.git] / arch / powerpc / mm / fault.c

diff --git a/arch/powerpc/mm/fault.c b/arch/powerpc/mm/fault.c
index b5047f9b5dec4d97c03e84ebccf5c32a9bfac515..8db0507619e23396866b9505257d94a3f322186e 100644 (file)
--- a/arch/powerpc/mm/fault.c
+++ b/arch/powerpc/mm/fault.c
@@ -233,7 +233,7 @@ static bool bad_kernel_fault(struct pt_regs *regs, unsigned long error_code,
 
        // Read/write fault in a valid region (the exception table search passed
        // above), but blocked by KUAP is bad, it can never succeed.
-       if (bad_kuap_fault(regs, is_write))
+       if (bad_kuap_fault(regs, address, is_write))
                return true;
 
        // What's left? Kernel fault on user in well defined regions (extable
@@ -279,12 +279,8 @@ static bool bad_stack_expansion(struct pt_regs *regs, unsigned long address,
                if ((flags & FAULT_FLAG_WRITE) && (flags & FAULT_FLAG_USER) &&
                    access_ok(nip, sizeof(*nip))) {
                        unsigned int inst;
-                       int res;
 
-                       pagefault_disable();
-                       res = __get_user_inatomic(inst, nip);
-                       pagefault_enable();
-                       if (!res)
+                       if (!probe_user_read(&inst, nip, sizeof(inst)))
                                return !store_updates_sp(inst);
                        *must_retry = true;
                }
@@ -354,6 +350,9 @@ static void sanity_check_fault(bool is_write, bool is_user,
         * Userspace trying to access kernel address, we get PROTFAULT for that.
         */
        if (is_user && address >= TASK_SIZE) {
+               if ((long)address == -1)
+                       return;
+
                pr_crit_ratelimited("%s[%d]: User access of kernel address (%lx) - exploit attempt? (uid: %d)\n",
                                   current->comm, current->pid, address,
                                   from_kuid(&init_user_ns, current_uid()));