Note that copy_to_kernel_nofault() uses pagefault_disable(), but it
still faults. This is because with Supervisor Mode Access Prevention
(SMAP) enabled, do_user_addr_fault() Oopses on a fault for a user
address from kernel space _before_ checking faulthandler_disabled().

copy_from_kernel_nofault() avoids this by checking that the address is
in the kernel before doing the actual memory access. Do the same in
copy_to_kernel_nofault() so that we get an error as expected:

   # echo ttyS0 > /sys/module/kgdboc/parameters/kgdboc
   # echo g > /proc/sysrq-trigger
   ...
   [17]kdb> mm 0 1234
   kdb_putarea_size: Bad address 0x0
   diag: -21: Invalid address

Signed-off-by: Omar Sandoval <redacted>
---
  mm/maccess.c | 3 +++
  1 file changed, 3 insertions(+)

diff --git a/mm/maccess.c b/mm/maccess.c
index 72e9c03ea37f..d67dee51a1cc 100644
--- a/mm/maccess.c
+++ b/mm/maccess.c

@@ -61,6 +61,9 @@ long copy_to_kernel_nofault(void *dst, const void *src, size_t size)
         if (!IS_ENABLED(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS))
                 align = (unsigned long)dst | (unsigned long)src;

+       if (!copy_kernel_nofault_allowed(dst, size))
+               return -ERANGE;
+
         pagefault_disable();
         if (!(align & 7))
                 copy_to_kernel_nofault_loop(dst, src, size, u64, Efault);
--

2.46.0