[PATCH] arm64: mm: Walk page tables with interrupts disabled in show_pte()

[PATCH] arm64: mm: Walk page tables with interrupts disabled in show_pte()

[Karl Mehltretter]

show_pte() walks the page tables locklessly and can run with interrupts
enabled, so a concurrent teardown (e.g. munmap() in another thread of
the faulting mm) can free a table page from under it. Dereferencing the
freed page can fault again or print garbage in the oops report.

arm64 selects MMU_GATHER_RCU_TABLE_FREE, and the documented protection
for lockless walkers is disabling interrupts, as gup_fast() does. That
holds off the RCU-deferred table frees and, unlike rcu_read_lock(),
also blocks the IPI-based synchronisation (tlb_remove_table_sync_one())
that khugepaged collapse uses before reusing a table.

Use guard(irqsave)() around the complete walk. This does not make the
diagnostic output a consistent snapshot, but prevents it from
dereferencing a released page-table page.

Fixes: 1d18c47c735e ("arm64: MMU fault handling and page table management")
Assisted-by: Codex:gpt-5.6-sol
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
---
Testing: QEMU arm64 virt guest, 2 vCPUs, debug_pagealloc=on. A racing
page-table unmap triggered a nested fault in the walk without this
patch, none with it.

 arch/arm64/mm/fault.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index 0b52557652be6..b173eebd3cd19 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -16,6 +16,7 @@
 #include <linux/mm.h>
 #include <linux/hardirq.h>
 #include <linux/init.h>
+#include <linux/irqflags.h>
 #include <linux/kasan.h>
 #include <linux/kprobes.h>
 #include <linux/uaccess.h>
@@ -151,6 +152,8 @@ static void show_pte(unsigned long addr)
 		return;
 	}
 
+	guard(irqsave)();
+
 	pr_alert("%s pgtable: %luk pages, %llu-bit VAs, pgdp=%016lx\n",
 		 mm == &init_mm ? "swapper" : "user", PAGE_SIZE / SZ_1K,
 		 vabits_actual, mm_to_pgd_phys(mm));
-- 
2.53.0