Linus Torvalds 9ef61ff7ca syscall_user_dispatch: Use get_user() for the selector ... syscall_user_dispatch() reads the selector byte with __get_user(), relying on an access_ok() done once at prctl time when the selector address was set. So the pointer being dereferenced was validated in a different system call, and the separation saves nothing anyway: __get_user() still enables and disables user access, and on x86 it does an lfence that get_user() avoids. Use get_user(), and drop the comment explaining why the unchecked access was safe. The selector may be a tagged address. The prctl-time check is done on untagged_addr(selector), but it is the tagged pointer that gets stored, and __get_user() never checked it. get_user() does, and on x86 with LAM a tagged pointer fails its range check. So untag it at the point of use as well. The prctl-time check stays, so a bad address is still reported when it is set. This is part of getting rid of __get_user() and __put_user() entirely. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2026-10-19 19:23:28 -10:00
..
common.c
Makefile
syscall_user_dispatch.c	syscall_user_dispatch: Use get_user() for the selector	2026-10-19 19:23:28 -10:00
syscall-common.c
virt.c