csky: alignment: validate address before emulated load/store

The abiv1 misalignment fixup csky_alignment() re-executes a trapped unaligned load/store from kernel context. It computes the target address entirely from user-controlled state -- the base register read from the saved user regs via get_ptreg() plus an immediate decoded from the faulting instruction -- and then performs the access with raw supervisor ldb/stb instructions in ldb_asm()/stb_asm(), without checking that the address points into user space.

A local unprivileged process can therefore execute a crafted unaligned STW/STH whose base register holds a kernel address: the fixup emulates it and stores an attacker-controlled value to an attacker-chosen kernel address -- an arbitrary kernel write, i.e. a privilege-escalation primitive. The symmetric load path is an arbitrary kernel read. The __ex_table entry on the asm only recovers from an unmapped fault; a store to a mapped, writable kernel page completes. The existing rx/rz != {0,1} test is a register-index filter, not an address bound.

Reject the emulated access when the fault came from user mode and the target is not a valid user address, using access_ok(). Rejected accesses fall through to the existing bad_area path, which delivers SIGBUS/BUS_ADRALN like every other rejected case. Kernel-mode faults legitimately touch kernel memory and are deliberately left unchecked.

Found by inspection; CK610 (CONFIG_CPU_CK610) abiv1 silicon has no upstream emulation target, so this is not runtime-reproduced.

---
 arch/csky/abiv1/alignment.c | 8 ++++++++
 1 file changed, 8 insertions(+)

index aee904833dec..19337946e0d5 100644
@@ -261,18 +261,26 @@ void csky_alignment(struct pt_regs *regs)
 	switch (opcode) {
 	case OP_LDH:
 		addr = get_ptreg(regs, rx) + (imm << 1);
+		if (user_mode(regs) && !access_ok((void __user *)addr, 2))
+			goto bad_area;
 		ret = ldh_c(regs, rz, addr);
 		break;
 	case OP_LDW:
 		addr = get_ptreg(regs, rx) + (imm << 2);
+		if (user_mode(regs) && !access_ok((void __user *)addr, 4))
+			goto bad_area;
 		ret = ldw_c(regs, rz, addr);
 		break;
 	case OP_STH:
 		addr = get_ptreg(regs, rx) + (imm << 1);
+		if (user_mode(regs) && !access_ok((void __user *)addr, 2))
+			goto bad_area;
 		ret = sth_c(regs, rz, addr);
 		break;
 	case OP_STW:
 		addr = get_ptreg(regs, rx) + (imm << 2);
+		if (user_mode(regs) && !access_ok((void __user *)addr, 4))
+			goto bad_area;
 		ret = stw_c(regs, rz, addr);
 		break;
 	}

--
2.50.1 (Apple Git-155)