Re: [PATCH 1/3] arm64: perf: Skip device memory during user callchain unwinding

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] The device memory check only validates the starting address of the user frame, allowing a cross-page boundary bypass that still panics the kernel.
--

commit e9c0174fdde1a5c6f32621d5e911c732eed46d59
Author: Fredrik Markstrom <fredrik.markstrom@est.tech>

arm64: perf: Skip device memory during user callchain unwinding

This commit adds a lockless page table walk to inspect the MAIR attribute
index before reading a user frame pointer. This aims to prevent reading
from device memory regions during stack unwinding, which can trigger bus
errors and panic the kernel.

> diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
> index 3ebcf8c53fb0..6426a307b8f8 100644
> --- a/arch/arm64/kernel/stacktrace.c
> +++ b/arch/arm64/kernel/stacktrace.c
[ ... ]
> @@ -524,6 +616,9 @@ unwind_user_frame(struct frame_tail __user *tail, void *cookie,
>  	if (!access_ok(tail, sizeof(buftail)))
>  		return NULL;
>  
> +	if (addr_is_device_mem((unsigned long)tail))
> +		return NULL;
> +

Could this allow a read across a page boundary into device memory?

If tail is 8-byte aligned and resides 8 bytes before the end of a normal
memory page, addr_is_device_mem() will only check the first page and
return false.

Because struct frame_tail is 16 bytes, the subsequent copy will cross
the page boundary:

>  	pagefault_disable();
>  	err = __copy_from_user_inatomic(&buftail, tail, sizeof(buftail));

If the adjacent page is mapped as device memory, wouldn't this still
trigger the Synchronous External Abort the patch is trying to fix?

[ ... ]
> @@ -572,6 +667,9 @@ unwind_compat_user_frame(struct compat_frame_tail __user *tail, void *cookie,
>  	if (!access_ok(tail, sizeof(buftail)))
>  		return NULL;
>  
> +	if (addr_is_device_mem((unsigned long)tail))
> +		return NULL;
> +

Does this have the same page boundary issue?

Since struct compat_frame_tail is 8 bytes, an address aligned to 4 bytes at
the end of the page could similarly result in reading 4 bytes from an
adjacent device memory page.

>  	pagefault_disable();
>  	err = __copy_from_user_inatomic(&buftail, tail, sizeof(buftail));

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260428-master-with-pfix-v3-v1-0-c384d3e53092@est.tech?part=1