setup_trampoline() writes the seven words of the on-stack sigreturn trampoline with __put_user(), relying on the frame having been checked when the frame setup opened its user write access. It is called after that access has been closed again, so each of the seven writes opens and closes user access on its own. Write them inside one scoped_user_write_access_size() covering the whole trampoline instead. Everything in it is a store, so a write-only window is enough, and the instruction cache flush stays outside it. This is part of getting rid of __get_user() and __put_user() entirely. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>