Re: [PATCH] ARM: nwfpe: use task_pt_regs() to find user registers

["Arnd Bergmann" <arnd@arndb.de>]

On Thu, Nov 12, 2026, at 03:51, Patrick Lister wrote:
> NWFPE locates the trapping process's saved registers relative to
> current_thread_info(), assuming thread_info sits at the bottom of the
> kernel stack. Since ARM moved thread_info into task_struct, that
> expression points past the end of the task_struct instead.
>
> This breaks FPA instruction emulation, as the user registers are
> never read or written and causes out-of-bounds reads and writes of
> kernel memory beyond the task_struct. Any unprivileged process can
> trigger this.

Thanks a lot for chasing this down!

As I understand it, this means that nobody has seriously used or
tested OABI since 5.16. I last tested it myself in 5.14 when
working on 4e57a4ddf6b0 ("ARM: 9107/1: syscall: always store
thread_info->abi_syscall"), but it was quite hard to properly
test it at the time, even getting an old Debian rootfs to work
with a modern kernel and qemu was nontrivial.

> Fix by using task_pt_regs(current), which finds the registers on the
> stack.
>
> The bug was found with assistance from Claude Code (Anthropic), model
> Claude Opus 5.5 (claude-opus-5-5).
>
> Fixes: 18ed1c01a7dd ("ARM: smp: Enable THREAD_INFO_IN_TASK")
> Fixes: 9c46929e7989 ("ARM: implement THREAD_INFO_IN_TASK for
> uniprocessor systems")
> Cc: stable@vger.kernel.org # 5.16+
> Signed-off-by: Patrick Lister <patrick.lister.dev@gmail.com>

Reviewed-by: Arnd Bergmann <arnd@arndb.de>

The patch looks fine, and it's clearly harmless to merge as there
are no users, so please add it to the patch tracker according to
the instructions at https://www.arm.linux.org.uk/developer/patches/info.php

Hopefully this way we can have OABI/NWFPE in a working state for the
LTS backports when we remove it in the near future, in case
anyone ever wants to play with it later.

I've added the maintainers for the Arm ports in gcc, qemu and binutils
to Cc here, I believe all of these still have some level of OABI
support that they kept just because Linux still handles it, but
that can then also be removed.

      Arnd