1 files changed, 8 insertions, 0 deletions

diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index d64c00afceb5..94b0e37d90ef 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -14,6 +14,8 @@
 #include <linux/syscalls.h>
 #include <linux/error-injection.h>
 
+#include <asm/tlb.h>
+
 #include "trace_probe.h"
 #include "trace.h"
 
@@ -163,6 +165,10 @@ BPF_CALL_3(bpf_probe_write_user, void *, unsafe_ptr, const void *, src,
          * access_ok() should prevent writing to non-user memory, but in
          * some situations (nommu, temporary switch, etc) access_ok() does
          * not provide enough validation, hence the check on KERNEL_DS.
+         *
+         * nmi_uaccess_okay() ensures the probe is not run in an interim
+         * state, when the task or mm are switched. This is specifically
+         * required to prevent the use of temporary mm.
          */
 
         if (unlikely(in_interrupt() ||
@@ -170,6 +176,8 @@ BPF_CALL_3(bpf_probe_write_user, void *, unsafe_ptr, const void *, src,
                 return -EPERM;
         if (unlikely(uaccess_kernel()))
                 return -EPERM;
+        if (unlikely(!nmi_uaccess_okay()))
+                return -EPERM;
         if (!access_ok(unsafe_ptr, size))
                 return -EPERM;