[PATCH v2 4/8] powerpc/signal64: Access function descriptor with scoped user access
From: "Christophe Leroy (CS GROUP)" <chleroy@kernel.org>
Date: 2026-06-02 08:47:20
Also in:
lkml
Subsystem:
linux for powerpc (32-bit and 64-bit), the rest · Maintainers:
Madhavan Srinivasan, Michael Ellerman, Linus Torvalds
Access the function descriptor of the handler within a scoped user access block. Signed-off-by: Christophe Leroy (CS GROUP) <chleroy@kernel.org> --- arch/powerpc/kernel/signal_64.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index 4ff8ad5d60d0..d23a980b32a8 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c@@ -932,8 +932,10 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set, struct func_desc __user *ptr = (struct func_desc __user *)ksig->ka.sa.sa_handler; - err |= get_user(regs->ctr, &ptr->addr); - err |= get_user(regs->gpr[2], &ptr->toc); + scoped_user_read_access(ptr, badfunc) { + unsafe_get_user(regs->ctr, &ptr->addr, badfunc); + unsafe_get_user(regs->gpr[2], &ptr->toc, badfunc); + } } /* enter the signal handler in native-endian mode */
@@ -956,5 +958,10 @@ int handle_rt_signal64(struct ksignal *ksig, sigset_t *set, badframe: signal_fault(current, regs, "handle_rt_signal64", frame); + return 1; + +badfunc: + signal_fault(current, regs, __func__, (void __user *)ksig->ka.sa.sa_handler); + return 1; }
--
2.54.0