[PATCH RESEND] ARM: alignment: restore uaccess state on emulation fault

[Linus Walleij]

On Tue, Aug 11, 2026 at 6:45 PM Karl Mehltretter <kmehltretter at gmail.com> wrote:

> The alignment handlers enable access to user memory while emulating
> unaligned instructions. If a checked access faults, its exception table
> fixup jumps to the handler's fault label and bypasses uaccess_restore().
> This leaves DOMAIN_USER as DOMAIN_CLIENT with SW domain PAN, or leaves
> TTBR0 page table walks enabled with TTBR0 PAN, while the fault is handled.
>
> An ARM926 QEMU test using LDMIA across an unmapped page boundary reports
> DOMAIN_USER=1 at TYPE_FAULT before this change and DOMAIN_USER=0 after it.
> SW domain PAN is the default on ARMv5, ARMv6, and non-LPAE ARMv7 builds.
>
> Keep the saved uaccess state at function scope and track whether it was
> saved. Restore it at the fault label only when needed. Paths that did not
> enable user access continue to skip the restore.
>
> Fixes: 274e91b81ed2 ("ARM: alignment: fix alignment handling for uaccess changes")
> Cc: stable at vger.kernel.org
> Assisted-by: Codex:gpt-5.6-sol
> Signed-off-by: Karl Mehltretter <kmehltretter at gmail.com>

Wow nice patch!
Reviewed-by: Linus Walleij <linusw at kernel.org>

Please put this patch into Russell's patch tracker so he can
apply it!
https://www.arm.linux.org.uk/developer/patches/

Yours,
Linus Walleij