Re: [PATCH v2 1/3] arm64: perf: Skip device memory during user callchain unwinding

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Time-of-Check to Time-of-Use (TOCTOU) race in the lockless device memory check leaves a window for a kernel panic.
--

commit ed429c75630a0d1b28e968c7cbc91dc9b7885fe0
Author: Fredrik Markstrom <fredrik.markstrom@est.tech>

arm64: perf: Skip device memory during user callchain unwinding

This commit adds a lockless page table walk to inspect the MAIR
attribute index in leaf PTEs before reading userspace frame pointers
during callchain unwinding. If the PTE indicates device memory, the
frame is skipped to prevent kernel crashes from MMIO reads.

> diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c
> index 3ebcf8c53fb04..4a28df9bbe763 100644
> --- a/arch/arm64/kernel/stacktrace.c
> +++ b/arch/arm64/kernel/stacktrace.c
[ ... ]
> @@ -524,6 +627,9 @@ unwind_user_frame(struct frame_tail __user *tail, void *cookie,
>  	if (!access_ok(tail, sizeof(buftail)))
>  		return NULL;
>  
> +	if (range_is_device_mem((unsigned long)tail, sizeof(buftail)))
> +		return NULL;
> +
>  	pagefault_disable();
>  	err = __copy_from_user_inatomic(&buftail, tail, sizeof(buftail));
>  	pagefault_enable();

Does this TOCTOU race still leave a window for a kernel panic?

While the commit message notes this race, a concurrent thread could remap
the target address to device memory between the check in range_is_device_mem()
and the read in __copy_from_user_inatomic().

Since arm64 hardware TLB invalidation broadcasts to all CPUs without requiring
software IPI participation, could the racing thread successfully replace the
VMA and update the TLB even if the unwinding CPU has interrupts disabled?

Additionally, when called from process context via ftrace, interrupts are
fully re-enabled after the check, which might allow preemption to widen the
race window significantly.

Could this allow an unprivileged attacker to trigger a synchronous external
abort and cause a local denial of service?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260430-master-with-pfix-v3-v2-0-bd526ec04a75@est.tech?part=1