Removing __get_user / __put_user for good

Removing __get_user / __put_user for good

[Linus Torvalds]

Bah. I made this branch of mine public because I wanted Michael
Tsirkin to check the vhost part.

But honestly, the i915 side and the coco/SEV patches are the much more
interesting ones.

So this brings in some new victims^Hpeople for that git branch to comment on.

It's all in

  git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
uaccess-cleanup

I haven't dared actually boot it yet.

                    Linus

On Mon, 19 Oct 2026 at 20:51, Linus Torvalds
<torvalds@linuxfoundation.org> wrote:
>
> I have a whole branch that removes __get_user() and __put_user() entirely.
>
> Somebody should check that I did it right. But I didn't want to do the
> pagefault_disable() around the vringh_notify() part, so it's not quite
> the same as yours.
>
> Let me just push it out. I was going to let it simmer, but your email
> made me go "I should just let more people look at it".
>
> Mind taking a look at the 'uaccess-cleanups' branch?
>
> It builds for me. That's all the testing it has gotten so far. Blush.
>
>                    Linus

Re: Removing __get_user / __put_user for good

[Jani Nikula]

On Mon, 19 Oct 2026, Linus Torvalds <torvalds@linuxfoundation.org> wrote:
> Bah. I made this branch of mine public because I wanted Michael
> Tsirkin to check the vhost part.
>
> But honestly, the i915 side and the coco/SEV patches are the much more
> interesting ones.
>
> So this brings in some new victims^Hpeople for that git branch to comment on.
>
> It's all in
>
>   git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> uaccess-cleanup
>
> I haven't dared actually boot it yet.

I rebased it on top of our development branch and sent it to i915
CI. Let's see if it blows up. ;)


BR,
Jani.


-- 
Jani Nikula, Intel

Re: Removing __get_user / __put_user for good

[Michael S. Tsirkin]

On Mon, Oct 19, 2026 at 09:25:02PM -1000, Linus Torvalds wrote:
> Bah. I made this branch of mine public because I wanted Michael
> Tsirkin to check the vhost part.
> 
> But honestly, the i915 side and the coco/SEV patches are the much more
> interesting ones.
> 
> So this brings in some new victims^Hpeople for that git branch to comment on.
> 
> It's all in
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> uaccess-cleanup
> 
> I haven't dared actually boot it yet.
> 
>                     Linus

vpda seems to survive light testing in a VM for me.

Tested-by: Michael S. Tsirkin <mst@redhat.com>


It's still buggy if there is a swapout right before
the access, just like it was previously, but hey.
One splat less. An improvement.

You might want:

Fixes: 42823a871fd4 ("vringh: support VA with iotlb")

with that, vdpa/vhost bits:

Acked-by: Michael S. Tsirkin <mst@redhat.com>



> On Mon, 19 Oct 2026 at 20:51, Linus Torvalds
> <torvalds@linuxfoundation.org> wrote:
> >
> > I have a whole branch that removes __get_user() and __put_user() entirely.
> >
> > Somebody should check that I did it right. But I didn't want to do the
> > pagefault_disable() around the vringh_notify() part, so it's not quite
> > the same as yours.
> >
> > Let me just push it out. I was going to let it simmer, but your email
> > made me go "I should just let more people look at it".
> >
> > Mind taking a look at the 'uaccess-cleanups' branch?
> >
> > It builds for me. That's all the testing it has gotten so far. Blush.
> >
> >                    Linus

Re: Removing __get_user / __put_user for good

[Ingo Molnar]

* Linus Torvalds <torvalds@linuxfoundation.org> wrote:

> Bah. I made this branch of mine public because I wanted Michael
> Tsirkin to check the vhost part.
> 
> But honestly, the i915 side and the coco/SEV patches are the much more
> interesting ones.
> 
> So this brings in some new victims^Hpeople for that git branch to comment on.
> 
> It's all in
> 
>   git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> uaccess-cleanup

So it's 'uaccess-cleanups', plural, in case someone copy & pasted
this URI verbatim instead of using the branch name from your
earlier mail. :-)

All the x86 cleanups look good to me in principle, and a quick
test-build & boot shows no problems (both on 64-bit and 32-bit),
but regular testing doesn't fully excercise the exception paths
of these changes, so YMMV.

( BTW., there's a new dependency introduced by this series,
  if an architecture gets rid of __get_user(), then it must
  define arch_get_kernel_nofault(), otherwise it will gain
  new uses of __get_user()/__put_user() via the generic implementations
  of __get_kernel_nofault() and __put_kernel_nofault(). No big deal
  I suppose. )

Thanks,

	Ingo

Re: Removing __get_user / __put_user for good

[Linus Torvalds]

On Tue, 20 Oct 2026 at 03:19, Ingo Molnar <mingo@kernel.org> wrote:
>
> ( BTW., there's a new dependency introduced by this series,
>   if an architecture gets rid of __get_user(), then it must
>   define arch_get_kernel_nofault(), otherwise it will gain
>   new uses of __get_user()/__put_user() via the generic implementations
>   of __get_kernel_nofault() and __put_kernel_nofault(). No big deal
>   I suppose. )

Yeah. It didn't actually look too bad to just remove __get_user and
__put_user in general, but I ran out of motivation.

On arm64, it's a non-issue: __get/put_user is the same thing as
get/put_user, and they both do the full checks.

And the bulk of the remaining cases were on architectures that I
didn't feel were a big issue: alpha/mips/sparc.

I *think* they are all trivial - the bulk of them are just the
historical signal stack stuff and should be a direct conversion to
unsafe_get/put_user() wrapped with scoped_user_read/write_access().

So I think 90% of the remaining noise is truly trivial - not like some
of the cases that actually had *semantic* reasons to use
__get/put_user (often very _bad_ semantic reasons, but still).

Not a huge deal, I might get around to it while waiting for test
builds. Or I might not.

                 Linus

Re: Removing __get_user / __put_user for good

[Linus Torvalds]

On Tue, 20 Oct 2026 at 08:14, Linus Torvalds
<torvalds@linuxfoundation.org> wrote:
>
> On Tue, 20 Oct 2026 at 03:19, Ingo Molnar <mingo@kernel.org> wrote:
> >
> > ( BTW., there's a new dependency introduced by this series,
> >   if an architecture gets rid of __get_user(), then it must
> >   define arch_get_kernel_nofault(), otherwise it will gain
> >   new uses of __get_user()/__put_user() via the generic implementations
> >   of __get_kernel_nofault() and __put_kernel_nofault(). No big deal
> >   I suppose. )
>
> Yeah. It didn't actually look too bad to just remove __get_user and
> __put_user in general, but I ran out of motivation.

Bah. I'm using claude as a fancy coccinelle script, and ended up doing
the ObviouslyCorrect(tm) safe cases.

And it all really does look obviously correct, but ...

Anyway, the branch has been partially rebased to add the acked-by from
Michael, and now has a number of those "obvious" patches for alpha,
hexagon, 32-bit arm and powerpc.

I think I have - once again - run out of motivation to go further.
There are still various __get_user and __put_user calls around, but
they are starting to get rare, and I've run out of cases that look
obvious.

For example, I looked at the sparc32 signal cases, and decided
somebody else needs to do that part. It just looks too messy, and I
can't find it in myself to care. Same goes for m68k, loongarch, parisc
and mips. I just ran out of steam.

But I think this *did* get rid of the bulk of the noise elsewhere, so
now it's hopefully a case of "a motivated architecture maintainer has
a few cases to look at".

                 Linus