ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faultsgrafted

When CONFIG_DEBUG_USER=y, and cmdline "user_debug=31" is set,
a user fault may trigger show_pte() without any lock.
If another thread in the same process concurrently calls munmap(),
the page table pages may be freed while show_pte() is still traversing
them, causing a use-after-free in show_pte().

If CONFIG_ARM_LPAE=y, this may cause a kernel panic if the pages table
of PMD are freed when show_pte() is running.

Acquire mmap_write_lock() around show_pte() for user faults to fix the
contention.

For user faults, additionally restrict that show_pte() is called only
when the addr is a user-space address (addr < TASK_SIZE). This is because
the lock of tsk->mm only protects the virtual memory of user address space,
furthermore, dumping the page tables of a kernel-space address for user
faults is unnecessary and may have security implications.

Keep everything unchanged for kernel faults, because the kernel is
already in the "oops" state, acquiring a lock may risk a deadlock.

Co-developed-by: Qi Xi <xiqi2@huawei.com>

Fixes: 6d021b724481 ("ARM: dump pgd, pmd and pte states on unhandled data abort faults")
Link: https://lore.kernel.org/20260716014022.2823-1-xieyuanbin1@huawei.com
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Qi Xi <xiqi2@huawei.com>
Signed-off-by: Xie Yuanbin <xieyuanbin1@huawei.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>

1 files changed, 90 insertions, 0 deletions

diff --git a/include/sound/initval.h b/include/sound/initval.h
new file mode 100644
index 000000000..a1ff3b486
--- /dev/null
+++ b/include/sound/initval.h
@@ -0,0 +1,90 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef __SOUND_INITVAL_H
+#define __SOUND_INITVAL_H
+
+/*
+ *  Init values for soundcard modules
+ *  Copyright (c) by Jaroslav Kysela <perex@perex.cz>
+ */
+
+#define SNDRV_AUTO_PORT		1
+#define SNDRV_AUTO_IRQ		0xffff
+#define SNDRV_AUTO_DMA		0xffff
+#define SNDRV_AUTO_DMA_SIZE	(0x7fffffff)
+
+#define SNDRV_DEFAULT_IDX1	(-1)
+#define SNDRV_DEFAULT_STR1	NULL
+#define SNDRV_DEFAULT_ENABLE1	1
+#define SNDRV_DEFAULT_PORT1	SNDRV_AUTO_PORT
+#define SNDRV_DEFAULT_IRQ1	SNDRV_AUTO_IRQ
+#define SNDRV_DEFAULT_DMA1	SNDRV_AUTO_DMA
+#define SNDRV_DEFAULT_DMA_SIZE1	SNDRV_AUTO_DMA_SIZE
+#define SNDRV_DEFAULT_PTR1	SNDRV_DEFAULT_STR1
+
+#define SNDRV_DEFAULT_IDX	{ [0 ... (SNDRV_CARDS-1)] = -1 }
+#define SNDRV_DEFAULT_STR	{ [0 ... (SNDRV_CARDS-1)] = NULL }
+#define SNDRV_DEFAULT_ENABLE	{ 1, [1 ... (SNDRV_CARDS-1)] = 0 }
+#define SNDRV_DEFAULT_ENABLE_PNP { [0 ... (SNDRV_CARDS-1)] = 1 }
+#ifdef CONFIG_PNP
+#define SNDRV_DEFAULT_ENABLE_ISAPNP SNDRV_DEFAULT_ENABLE_PNP
+#else
+#define SNDRV_DEFAULT_ENABLE_ISAPNP SNDRV_DEFAULT_ENABLE
+#endif
+#define SNDRV_DEFAULT_PORT	{ [0 ... (SNDRV_CARDS-1)] = SNDRV_AUTO_PORT }
+#define SNDRV_DEFAULT_IRQ	{ [0 ... (SNDRV_CARDS-1)] = SNDRV_AUTO_IRQ }
+#define SNDRV_DEFAULT_DMA	{ [0 ... (SNDRV_CARDS-1)] = SNDRV_AUTO_DMA }
+#define SNDRV_DEFAULT_DMA_SIZE	{ [0 ... (SNDRV_CARDS-1)] = SNDRV_AUTO_DMA_SIZE }
+#define SNDRV_DEFAULT_PTR	SNDRV_DEFAULT_STR
+
+#ifdef SNDRV_LEGACY_FIND_FREE_IOPORT
+static long snd_legacy_find_free_ioport(const long *port_table, long size)
+{
+	while (*port_table != -1) {
+		if (request_region(*port_table, size, "ALSA test")) {
+			release_region(*port_table, size);
+			return *port_table;
+		}
+		port_table++;
+	}
+	return -1;
+}
+#endif
+
+#ifdef SNDRV_LEGACY_FIND_FREE_IRQ
+#include <linux/interrupt.h>
+
+static irqreturn_t snd_legacy_empty_irq_handler(int irq, void *dev_id)
+{
+	return IRQ_HANDLED;
+}
+
+static int snd_legacy_find_free_irq(const int *irq_table)
+{
+	while (*irq_table != -1) {
+		if (!request_irq(*irq_table, snd_legacy_empty_irq_handler,
+				 IRQF_PROBE_SHARED, "ALSA Test IRQ",
+				 (void *) irq_table)) {
+			free_irq(*irq_table, (void *) irq_table);
+			return *irq_table;
+		}
+		irq_table++;
+	}
+	return -1;
+}
+#endif
+
+#ifdef SNDRV_LEGACY_FIND_FREE_DMA
+static int snd_legacy_find_free_dma(const int *dma_table)
+{
+	while (*dma_table != -1) {
+		if (!request_dma(*dma_table, "ALSA Test DMA")) {
+			free_dma(*dma_table);
+			return *dma_table;
+		}
+		dma_table++;
+	}
+	return -1;
+}
+#endif
+
+#endif /* __SOUND_INITVAL_H */