syscall_user_dispatch: Use get_user() for the selector

syscall_user_dispatch() reads the selector byte with __get_user(),
relying on an access_ok() done once at prctl time when the selector
address was set.  So the pointer being dereferenced was validated in a
different system call, and the separation saves nothing anyway:
__get_user() still enables and disables user access, and on x86 it does
an lfence that get_user() avoids.

Use get_user(), and drop the comment explaining why the unchecked access
was safe.

The selector may be a tagged address.  The prctl-time check is done on
untagged_addr(selector), but it is the tagged pointer that gets stored,
and __get_user() never checked it.  get_user() does, and on x86 with LAM
a tagged pointer fails its range check.  So untag it at the point of use
as well.  The prctl-time check stays, so a bad address is still reported
when it is set.

This is part of getting rid of __get_user() and __put_user() entirely.

Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

0 files changed, 0 insertions, 0 deletions