ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faultsgrafted

When CONFIG_DEBUG_USER=y, and cmdline "user_debug=31" is set,
a user fault may trigger show_pte() without any lock.
If another thread in the same process concurrently calls munmap(),
the page table pages may be freed while show_pte() is still traversing
them, causing a use-after-free in show_pte().

If CONFIG_ARM_LPAE=y, this may cause a kernel panic if the pages table
of PMD are freed when show_pte() is running.

Acquire mmap_write_lock() around show_pte() for user faults to fix the
contention.

For user faults, additionally restrict that show_pte() is called only
when the addr is a user-space address (addr < TASK_SIZE). This is because
the lock of tsk->mm only protects the virtual memory of user address space,
furthermore, dumping the page tables of a kernel-space address for user
faults is unnecessary and may have security implications.

Keep everything unchanged for kernel faults, because the kernel is
already in the "oops" state, acquiring a lock may risk a deadlock.

Co-developed-by: Qi Xi <xiqi2@huawei.com>

Fixes: 6d021b724481 ("ARM: dump pgd, pmd and pte states on unhandled data abort faults")
Link: https://lore.kernel.org/20260716014022.2823-1-xieyuanbin1@huawei.com
Acked-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
Reviewed-by: Linus Walleij <linusw@kernel.org>
Signed-off-by: Qi Xi <xiqi2@huawei.com>
Signed-off-by: Xie Yuanbin <xieyuanbin1@huawei.com>
Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>

3 files changed, 92 insertions, 0 deletions

diff --git a/rust/proc-macro2/probe/proc_macro_span.rs b/rust/proc-macro2/probe/proc_macro_span.rs
new file mode 100644
index 000000000..892a7eb3e
--- /dev/null
+++ b/rust/proc-macro2/probe/proc_macro_span.rs
@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+// This code exercises the surface area that we expect of Span's unstable API.
+// If the current toolchain is able to compile it, then proc-macro2 is able to
+// offer these APIs too.
+
+#![cfg_attr(procmacro2_build_probe, feature(proc_macro_span))]
+
+extern crate proc_macro;
+
+use core::ops::{Range, RangeBounds};
+use proc_macro::{Literal, Span};
+use std::path::PathBuf;
+
+pub fn byte_range(this: &Span) -> Range<usize> {
+    this.byte_range()
+}
+
+pub fn start(this: &Span) -> Span {
+    this.start()
+}
+
+pub fn end(this: &Span) -> Span {
+    this.end()
+}
+
+pub fn line(this: &Span) -> usize {
+    this.line()
+}
+
+pub fn column(this: &Span) -> usize {
+    this.column()
+}
+
+pub fn file(this: &Span) -> String {
+    this.file()
+}
+
+pub fn local_file(this: &Span) -> Option<PathBuf> {
+    this.local_file()
+}
+
+pub fn join(this: &Span, other: Span) -> Option<Span> {
+    this.join(other)
+}
+
+pub fn subspan<R: RangeBounds<usize>>(this: &Literal, range: R) -> Option<Span> {
+    this.subspan(range)
+}
+
+// Include in sccache cache key.
+#[cfg(procmacro2_build_probe)]
+const _: Option<&str> = option_env!("RUSTC_BOOTSTRAP");
diff --git a/rust/proc-macro2/probe/proc_macro_span_file.rs b/rust/proc-macro2/probe/proc_macro_span_file.rs
new file mode 100644
index 000000000..f2dbc4056
--- /dev/null
+++ b/rust/proc-macro2/probe/proc_macro_span_file.rs
@@ -0,0 +1,16 @@
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+// The subset of Span's API stabilized in Rust 1.88.
+
+extern crate proc_macro;
+
+use proc_macro::Span;
+use std::path::PathBuf;
+
+pub fn file(this: &Span) -> String {
+    this.file()
+}
+
+pub fn local_file(this: &Span) -> Option<PathBuf> {
+    this.local_file()
+}
diff --git a/rust/proc-macro2/probe/proc_macro_span_location.rs b/rust/proc-macro2/probe/proc_macro_span_location.rs
new file mode 100644
index 000000000..ae19c9339
--- /dev/null
+++ b/rust/proc-macro2/probe/proc_macro_span_location.rs
@@ -0,0 +1,23 @@
+// SPDX-License-Identifier: Apache-2.0 OR MIT
+
+// The subset of Span's API stabilized in Rust 1.88.
+
+extern crate proc_macro;
+
+use proc_macro::Span;
+
+pub fn start(this: &Span) -> Span {
+    this.start()
+}
+
+pub fn end(this: &Span) -> Span {
+    this.end()
+}
+
+pub fn line(this: &Span) -> usize {
+    this.line()
+}
+
+pub fn column(this: &Span) -> usize {
+    this.column()
+}