ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faultsgrafted

When CONFIG_DEBUG_USER=y, and cmdline "user_debug=31" is set,
a user fault may trigger show_pte() without any lock.
If another thread in the same process concurrently calls munmap(),
the page table pages may be freed while show_pte() is still traversing
them, causing a use-after-free in show_pte().

If CONFIG_ARM_LPAE=y, this may cause a kernel panic if the pages table
of PMD are freed when show_pte() is running.

Acquire mmap_write_lock() around show_pte() for user faults to fix the
contention.

For user faults, additionally restrict that show_pte() is called only
when the addr is a user-space address (addr < TASK_SIZE). This is because
the lock of tsk->mm only protects the virtual memory of user address space,
furthermore, dumping the page tables of a kernel-space address for user
faults is unnecessary and may have security implications.

Keep everything unchanged for kernel faults, because the kernel is
already in the "oops" state, acquiring a lock may risk a deadlock.

Co-developed-by: Qi Xi <xiqi2@huawei.com>

Fixes: 6d021b724481 ("ARM: dump pgd, pmd and pte states on unhandled data abort faults")
Link: https://lore.kernel.org/20260716014022.2823-1-xieyuanbin1@huawei.com
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Qi Xi <xiqi2@huawei.com>
Signed-off-by: Xie Yuanbin <xieyuanbin1@huawei.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>

1 files changed, 161 insertions, 0 deletions

diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c
new file mode 100644
index 000000000..ffdcd4153
--- /dev/null
+++ b/fs/sysfs/dir.c
@@ -0,0 +1,161 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * fs/sysfs/dir.c - sysfs core and dir operation implementation
+ *
+ * Copyright (c) 2001-3 Patrick Mochel
+ * Copyright (c) 2007 SUSE Linux Products GmbH
+ * Copyright (c) 2007 Tejun Heo <teheo@suse.de>
+ *
+ * Please see Documentation/filesystems/sysfs.rst for more information.
+ */
+
+#define pr_fmt(fmt)	"sysfs: " fmt
+
+#include <linux/fs.h>
+#include <linux/kobject.h>
+#include <linux/slab.h>
+#include "sysfs.h"
+
+DEFINE_SPINLOCK(sysfs_symlink_target_lock);
+
+void sysfs_warn_dup(struct kernfs_node *parent, const char *name)
+{
+	char *buf;
+
+	buf = kzalloc(PATH_MAX, GFP_KERNEL);
+	if (buf)
+		kernfs_path(parent, buf, PATH_MAX);
+
+	pr_warn("cannot create duplicate filename '%s/%s'\n", buf, name);
+	dump_stack();
+
+	kfree(buf);
+}
+
+/**
+ * sysfs_create_dir_ns - create a directory for an object with a namespace tag
+ * @kobj: object we're creating directory for
+ * @ns: the namespace tag to use
+ */
+int sysfs_create_dir_ns(struct kobject *kobj, const struct ns_common *ns)
+{
+	struct kernfs_node *parent, *kn;
+	kuid_t uid;
+	kgid_t gid;
+
+	if (WARN_ON(!kobj))
+		return -EINVAL;
+
+	if (kobj->parent)
+		parent = kobj->parent->sd;
+	else
+		parent = sysfs_root_kn;
+
+	if (!parent)
+		return -ENOENT;
+
+	kobject_get_ownership(kobj, &uid, &gid);
+
+	kn = kernfs_create_dir_ns(parent, kobject_name(kobj), 0755, uid, gid,
+				  kobj, ns);
+	if (IS_ERR(kn)) {
+		if (PTR_ERR(kn) == -EEXIST)
+			sysfs_warn_dup(parent, kobject_name(kobj));
+		return PTR_ERR(kn);
+	}
+
+	kobj->sd = kn;
+	return 0;
+}
+
+/**
+ *	sysfs_remove_dir - remove an object's directory.
+ *	@kobj:	object.
+ *
+ *	The only thing special about this is that we remove any files in
+ *	the directory before we remove the directory, and we've inlined
+ *	what used to be sysfs_rmdir() below, instead of calling separately.
+ */
+void sysfs_remove_dir(struct kobject *kobj)
+{
+	struct kernfs_node *kn = kobj->sd;
+
+	/*
+	 * In general, kobject owner is responsible for ensuring removal
+	 * doesn't race with other operations and sysfs doesn't provide any
+	 * protection; however, when @kobj is used as a symlink target, the
+	 * symlinking entity usually doesn't own @kobj and thus has no
+	 * control over removal.  @kobj->sd may be removed anytime
+	 * and symlink code may end up dereferencing an already freed node.
+	 *
+	 * sysfs_symlink_target_lock synchronizes @kobj->sd
+	 * disassociation against symlink operations so that symlink code
+	 * can safely dereference @kobj->sd.
+	 */
+	spin_lock(&sysfs_symlink_target_lock);
+	kobj->sd = NULL;
+	spin_unlock(&sysfs_symlink_target_lock);
+
+	if (kn) {
+		WARN_ON_ONCE(kernfs_type(kn) != KERNFS_DIR);
+		kernfs_remove(kn);
+	}
+}
+
+int sysfs_rename_dir_ns(struct kobject *kobj, const char *new_name,
+			const struct ns_common *new_ns)
+{
+	struct kernfs_node *parent;
+	int ret;
+
+	parent = kernfs_get_parent(kobj->sd);
+	ret = kernfs_rename_ns(kobj->sd, parent, new_name, new_ns);
+	kernfs_put(parent);
+	return ret;
+}
+
+int sysfs_move_dir_ns(struct kobject *kobj, struct kobject *new_parent_kobj,
+		      const struct ns_common *new_ns)
+{
+	struct kernfs_node *kn = kobj->sd;
+	struct kernfs_node *new_parent;
+
+	new_parent = new_parent_kobj && new_parent_kobj->sd ?
+		new_parent_kobj->sd : sysfs_root_kn;
+
+	return kernfs_rename_ns(kn, new_parent, NULL, new_ns);
+}
+
+/**
+ * sysfs_create_mount_point - create an always empty directory
+ * @parent_kobj:  kobject that will contain this always empty directory
+ * @name: The name of the always empty directory to add
+ */
+int sysfs_create_mount_point(struct kobject *parent_kobj, const char *name)
+{
+	struct kernfs_node *kn, *parent = parent_kobj->sd;
+
+	kn = kernfs_create_empty_dir(parent, name);
+	if (IS_ERR(kn)) {
+		if (PTR_ERR(kn) == -EEXIST)
+			sysfs_warn_dup(parent, name);
+		return PTR_ERR(kn);
+	}
+
+	return 0;
+}
+EXPORT_SYMBOL_GPL(sysfs_create_mount_point);
+
+/**
+ *	sysfs_remove_mount_point - remove an always empty directory.
+ *	@parent_kobj: kobject that will contain this always empty directory
+ *	@name: The name of the always empty directory to remove
+ *
+ */
+void sysfs_remove_mount_point(struct kobject *parent_kobj, const char *name)
+{
+	struct kernfs_node *parent = parent_kobj->sd;
+
+	kernfs_remove_by_name_ns(parent, name, NULL);
+}
+EXPORT_SYMBOL_GPL(sysfs_remove_mount_point);