From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC2193FF1CB for ; Thu, 16 Jul 2026 13:47:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784209666; cv=none; b=Zc0df9a+ATZy239I2rRRNwLFfG40XlCBg/9aezvQvQ3TRK9bNlCYH9TXyBvcULpuObLec4dhJ5hlh6Z/lBwmlfXotdZ6M8G0vwiqph77Z9Sr+XYVP1XdW4WmVkdmeS/HF339i/kaoKBfTDYNmn+OvGzFSEajb20pp9/bKcDB5uk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784209666; c=relaxed/simple; bh=c/flTYOMBamaGb7AA+Mth4jcegYQ/13T7b8G/+93JqA=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=MKFy6yJ/HxgBPHuleLa7OWdxUOrUXV4+N8s58+NUFyW+WPlae2qcaLW06q0Hac24VeFB+2m17Z/4eO7CoSB29R7yaHBnuMIb8UEAo2w3sm4JiwD04Imw9/pWpJQgBRRYl7r4G7nltV5sdRqa2s6XHGBA3/eu9vMQlfGvqPOTFy0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=VaAqh2FV; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="VaAqh2FV" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5F4621F00A3F; Thu, 16 Jul 2026 13:47:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784209659; bh=vqxxc5A53OKhz48FL6b7XXdZbwD1IyUVhQ5mJc6kbbQ=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=VaAqh2FVMX4C//uMyZqUF9Rj9Pn3qi94kohEi3Arw4kg7GN6F2fJPrpj1eJdfSC3G R17ih9bnYM/9KKogFZD6ZIb4OAuJsTDeBVgYWCktZcHll6rPJUod5v4ppNFyJ6ZUE1 UVQ/VJXEaIjcv+0ga6ZlIMZ/hbsz7ysNZGD07me2ZNXQ0m0RC8UgnUHxj5vgRoTn/4 H949GtI8PqIZq636TkqbSGvNzW3TPeEKu5ZPt1U0qvAyyknBN0XzVyIL/hiWffJ4UW r/9RtgGsy8KRHtbODcBXel3R2k/68W2AMj/VnaKyKma8WzVtHzEzbuzcqx9yf3RnWb enbdap06JhsFA== Date: Thu, 16 Jul 2026 14:47:24 +0100 From: "Lorenzo Stoakes (ARM)" To: Xie Yuanbin Cc: linux@armlinux.org.uk, akpm@linux-foundation.org, xiqi2@huawei.com, david@kernel.org, linusw@kernel.org, liam@infradead.org, vbabka@kernel.org, rppt@kernel.org, surenb@google.com, mhocko@suse.com, will@kernel.org, linux-arm-kernel@lists.infradead.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, liaohua4@huawei.com, lilinjie8@huawei.com, sunnanyong@huawei.com Subject: Re: [PATCH v4] ARM: mm: acquire mmap write lock around show_pte() for user faults Message-ID: References: <20260716014022.2823-1-xieyuanbin1@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260716014022.2823-1-xieyuanbin1@huawei.com> On Thu, Jul 16, 2026 at 09:40:22AM +0800, Xie Yuanbin wrote: > When CONFIG_DEBUG_USER=y, and cmdline "user_debug=31" is set, > a user fault may trigger show_pte() without any lock. > If another thread in the same process concurrently calls munmap(), > the page table pages may be freed while show_pte() is still traversing > them, causing a use-after-free in show_pte(). > > If CONFIG_ARM_LPAE=y, this may cause a kernel panic if the pages table > of PMD are freed when show_pte() is running. > > Acquire mmap_write_lock() around show_pte() for user faults to fix the > contention. > > For user faults, additionally restrict that show_pte() is called only > when the addr is a user-space address (addr < TASK_SIZE). This is because > the lock of tsk->mm only protects the virtual memory of user address space, > furthermore, dumping the page tables of a kernel-space address for user > faults is unnecessary and may have security implications. > > Keep everything unchanged for kernel faults, because the kernel is > already in the "oops" state, acquiring a lock may risk a deadlock. > > Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") > Fixes: 6d021b724481 ("ARM: dump pgd, pmd and pte states on unhandled data abort faults") > Depends-on: <20260629123349.134224-1-xieyuanbin1@huawei.com> > Depends-on: 59e4f3b45b96 ("ARM: ensure interrupts are enabled in __do_user_fault()") > > Cc: Russell King > Suggested-by: Lorenzo Stoakes > Co-developed-by: Qi Xi > Signed-off-by: Qi Xi > Signed-off-by: Xie Yuanbin Acked-by: Lorenzo Stoakes (ARM) > --- > For __do_user_fault(), it must be a user fault, so the > judgement of user_mode(regs) can be omitted. > > For do_DataAbort(), it may be a user fault or a kernel fault. If it is > a kernel fault, it must be a kernel oops, the kernel will die soon. > Also, a user program may be constructed to trigger > do_DataAbort()->show_pte(), as described in this mail: > Link: https://lore.kernel.org/20260625100031.25088-1-xieyuanbin1@huawei.com > > For user faults, it is safe to acquire mmap_write_lock(), because > we never return to user with mmap lock held or pagefault disabled. > > Note that, due to the lack of ARMv4T for testing, this patch does not > fix the issue in baddataabort()->show_pte(). > > V3->V4: > - Keep nothing change for kernel faults. > - Change mmap read lock to write lock. > - Restrict that show_pte() is called only when the addr > is a user-space address (addr < TASK_SIZE). > > arch/arm/mm/fault.c | 16 ++++++++++++++-- > 1 file changed, 14 insertions(+), 2 deletions(-) > > diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c > index c68677503532..0a09d4ff7718 100644 > --- a/arch/arm/mm/fault.c > +++ b/arch/arm/mm/fault.c > @@ -174,21 +174,25 @@ __do_user_fault(unsigned long addr, unsigned int fsr, unsigned int sig, > struct task_struct *tsk = current; > > local_irq_enable(); > > #ifdef CONFIG_DEBUG_USER > if (((user_debug & UDBG_SEGV) && (sig == SIGSEGV)) || > ((user_debug & UDBG_BUS) && (sig == SIGBUS))) { > pr_err("8<--- cut here ---\n"); > pr_err("%s: unhandled page fault (%d) at 0x%08lx, code 0x%03x\n", > tsk->comm, sig, addr, fsr); > - show_pte(KERN_ERR, tsk->mm, addr); > + if (likely(addr < TASK_SIZE)) { > + mmap_write_lock(tsk->mm); > + show_pte(KERN_ERR, tsk->mm, addr); > + mmap_write_unlock(tsk->mm); > + } > show_regs(regs); > } > #endif > #ifndef CONFIG_KUSER_HELPERS > if ((sig == SIGSEGV) && ((addr & PAGE_MASK) == 0xffff0000)) > printk_ratelimited(KERN_DEBUG > "%s: CONFIG_KUSER_HELPERS disabled at 0x%08lx\n", > tsk->comm, addr); > #endif > > @@ -632,21 +636,29 @@ do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs) > > if (!inf->fn(addr, fsr & ~FSR_LNX_PF, regs)) > return; > > if (likely(user_mode(regs))) > local_irq_enable(); > > pr_alert("8<--- cut here ---\n"); > pr_alert("Unhandled fault: %s (0x%03x) at 0x%08lx\n", > inf->name, fsr, addr); > - show_pte(KERN_ALERT, current->mm, addr); > + if (likely(user_mode(regs))) { > + if (addr < TASK_SIZE) { > + mmap_write_lock(current->mm); > + show_pte(KERN_ALERT, current->mm, addr); > + mmap_write_unlock(current->mm); > + } > + } else { > + show_pte(KERN_ALERT, current->mm, addr); > + } > > arm_notify_die("", regs, inf->sig, inf->code, (void __user *)addr, > fsr, 0); > } > > void __init > hook_ifault_code(int nr, int (*fn)(unsigned long, unsigned int, struct pt_regs *), > int sig, int code, const char *name) > { > if (nr < 0 || nr >= ARRAY_SIZE(ifsr_info)) > -- > 2.53.0 > Cheers, Lorenzo