The abiv1 misalignment fixup csky_alignment() re-executes a trapped
unaligned load/store from kernel context. It computes the target address
entirely from user-controlled state -- the base register read from the
saved user regs via get_ptreg() plus an immediate decoded from the
faulting instruction -- and then performs the access with raw supervisor
ldb/stb instructions in ldb_asm()/stb_asm(), without checking that the
address points into user space.

A local unprivileged process can therefore execute a crafted unaligned
STW/STH whose base register holds a kernel address: the fixup emulates it
and stores an attacker-controlled value to an attacker-chosen kernel
address -- an arbitrary kernel write, i.e. a privilege-escalation
primitive. The symmetric load path is an arbitrary kernel read. The
__ex_table entry on the asm only recovers from an unmapped fault; a store
to a mapped, writable kernel page completes. The existing rx/rz != {0,1}
test is a register-index filter, not an address bound.

Reject the emulated access when the fault came from user mode and the
target is not a valid user address, using access_ok(). Rejected accesses
fall through to the existing bad_area path, which delivers
SIGBUS/BUS_ADRALN like every other rejected case. Kernel-mode faults
legitimately touch kernel memory and are deliberately left unchecked.

Found by inspection; CK610 (CONFIG_CPU_CK610) abiv1 silicon has no
upstream emulation target, so this is not runtime-reproduced.

Fixes: 081860b970ad ("csky: Exception handling and mm-fault")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
---
 arch/csky/abiv1/alignment.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/arch/csky/abiv1/alignment.c b/arch/csky/abiv1/alignment.c
index aee904833dec..19337946e0d5 100644
--- a/arch/csky/abiv1/alignment.c
+++ b/arch/csky/abiv1/alignment.c
@@ -261,18 +261,26 @@ void csky_alignment(struct pt_regs *regs)
 	switch (opcode) {
 	case OP_LDH:
 		addr = get_ptreg(regs, rx) + (imm << 1);
+		if (user_mode(regs) && !access_ok((void __user *)addr, 2))
+			goto bad_area;
 		ret = ldh_c(regs, rz, addr);
 		break;
 	case OP_LDW:
 		addr = get_ptreg(regs, rx) + (imm << 2);
+		if (user_mode(regs) && !access_ok((void __user *)addr, 4))
+			goto bad_area;
 		ret = ldw_c(regs, rz, addr);
 		break;
 	case OP_STH:
 		addr = get_ptreg(regs, rx) + (imm << 1);
+		if (user_mode(regs) && !access_ok((void __user *)addr, 2))
+			goto bad_area;
 		ret = sth_c(regs, rz, addr);
 		break;
 	case OP_STW:
 		addr = get_ptreg(regs, rx) + (imm << 2);
+		if (user_mode(regs) && !access_ok((void __user *)addr, 4))
+			goto bad_area;
 		ret = stw_c(regs, rz, addr);
 		break;
 	}
--
2.50.1 (Apple Git-155)