From 1039bffd6ae9c75b42b7d148d6c1106134107b66 Mon Sep 17 00:00:00 2001 From: Xie Yuanbin Date: Tue, 28 Jul 2026 03:16:42 +0100 Subject: ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults When CONFIG_DEBUG_USER=y, and cmdline "user_debug=31" is set, a user fault may trigger show_pte() without any lock. If another thread in the same process concurrently calls munmap(), the page table pages may be freed while show_pte() is still traversing them, causing a use-after-free in show_pte(). If CONFIG_ARM_LPAE=y, this may cause a kernel panic if the pages table of PMD are freed when show_pte() is running. Acquire mmap_write_lock() around show_pte() for user faults to fix the contention. For user faults, additionally restrict that show_pte() is called only when the addr is a user-space address (addr < TASK_SIZE). This is because the lock of tsk->mm only protects the virtual memory of user address space, furthermore, dumping the page tables of a kernel-space address for user faults is unnecessary and may have security implications. Keep everything unchanged for kernel faults, because the kernel is already in the "oops" state, acquiring a lock may risk a deadlock. Co-developed-by: Qi Xi Fixes: 6d021b724481 ("ARM: dump pgd, pmd and pte states on unhandled data abort faults") Link: https://lore.kernel.org/20260716014022.2823-1-xieyuanbin1@huawei.com Acked-by: Lorenzo Stoakes (ARM) Reviewed-by: Linus Walleij Signed-off-by: Qi Xi Signed-off-by: Xie Yuanbin Signed-off-by: Russell King --- include/soc/tegra/flowctrl.h | 71 ++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 include/soc/tegra/flowctrl.h (limited to 'include/soc/tegra/flowctrl.h') diff --git a/include/soc/tegra/flowctrl.h b/include/soc/tegra/flowctrl.h new file mode 100644 index 000000000..1aacc5c7a --- /dev/null +++ b/include/soc/tegra/flowctrl.h @@ -0,0 +1,71 @@ +/* SPDX-License-Identifier: GPL-2.0-only */ +/* + * Functions and macros to control the flowcontroller + * + * Copyright (c) 2010-2012, NVIDIA Corporation. All rights reserved. + */ + +#ifndef __SOC_TEGRA_FLOWCTRL_H__ +#define __SOC_TEGRA_FLOWCTRL_H__ + +#define FLOW_CTRL_HALT_CPU0_EVENTS 0x0 +#define FLOW_CTRL_WAITEVENT (2 << 29) +#define FLOW_CTRL_WAIT_FOR_INTERRUPT (4 << 29) +#define FLOW_CTRL_JTAG_RESUME (1 << 28) +#define FLOW_CTRL_SCLK_RESUME (1 << 27) +#define FLOW_CTRL_HALT_CPU_IRQ (1 << 10) +#define FLOW_CTRL_HALT_CPU_FIQ (1 << 8) +#define FLOW_CTRL_HALT_LIC_IRQ (1 << 11) +#define FLOW_CTRL_HALT_LIC_FIQ (1 << 10) +#define FLOW_CTRL_HALT_GIC_IRQ (1 << 9) +#define FLOW_CTRL_HALT_GIC_FIQ (1 << 8) +#define FLOW_CTRL_CPU0_CSR 0x8 +#define FLOW_CTRL_CSR_INTR_FLAG (1 << 15) +#define FLOW_CTRL_CSR_EVENT_FLAG (1 << 14) +#define FLOW_CTRL_CSR_ENABLE_EXT_CRAIL (1 << 13) +#define FLOW_CTRL_CSR_ENABLE_EXT_NCPU (1 << 12) +#define FLOW_CTRL_CSR_ENABLE_EXT_MASK ( \ + FLOW_CTRL_CSR_ENABLE_EXT_NCPU | \ + FLOW_CTRL_CSR_ENABLE_EXT_CRAIL) +#define FLOW_CTRL_CSR_ENABLE (1 << 0) +#define FLOW_CTRL_HALT_CPU1_EVENTS 0x14 +#define FLOW_CTRL_CPU1_CSR 0x18 + +#define TEGRA20_FLOW_CTRL_CSR_WFE_CPU0 (1 << 4) +#define TEGRA20_FLOW_CTRL_CSR_WFE_BITMAP (3 << 4) +#define TEGRA20_FLOW_CTRL_CSR_WFI_BITMAP 0 + +#define TEGRA30_FLOW_CTRL_CSR_WFI_CPU0 (1 << 8) +#define TEGRA30_FLOW_CTRL_CSR_WFE_BITMAP (0xF << 4) +#define TEGRA30_FLOW_CTRL_CSR_WFI_BITMAP (0xF << 8) + +#ifndef __ASSEMBLY__ +#ifdef CONFIG_SOC_TEGRA_FLOWCTRL +u32 flowctrl_read_cpu_csr(unsigned int cpuid); +void flowctrl_write_cpu_csr(unsigned int cpuid, u32 value); +void flowctrl_write_cpu_halt(unsigned int cpuid, u32 value); + +void flowctrl_cpu_suspend_enter(unsigned int cpuid); +void flowctrl_cpu_suspend_exit(unsigned int cpuid); +#else +static inline u32 flowctrl_read_cpu_csr(unsigned int cpuid) +{ + return 0; +} + +static inline void flowctrl_write_cpu_csr(unsigned int cpuid, u32 value) +{ +} + +static inline void flowctrl_write_cpu_halt(unsigned int cpuid, u32 value) {} + +static inline void flowctrl_cpu_suspend_enter(unsigned int cpuid) +{ +} + +static inline void flowctrl_cpu_suspend_exit(unsigned int cpuid) +{ +} +#endif /* CONFIG_SOC_TEGRA_FLOWCTRL */ +#endif /* __ASSEMBLY */ +#endif /* __SOC_TEGRA_FLOWCTRL_H__ */ -- cgit v1.3.1