From 1039bffd6ae9c75b42b7d148d6c1106134107b66 Mon Sep 17 00:00:00 2001 From: Xie Yuanbin Date: Tue, 28 Jul 2026 03:16:42 +0100 Subject: ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults When CONFIG_DEBUG_USER=y, and cmdline "user_debug=31" is set, a user fault may trigger show_pte() without any lock. If another thread in the same process concurrently calls munmap(), the page table pages may be freed while show_pte() is still traversing them, causing a use-after-free in show_pte(). If CONFIG_ARM_LPAE=y, this may cause a kernel panic if the pages table of PMD are freed when show_pte() is running. Acquire mmap_write_lock() around show_pte() for user faults to fix the contention. For user faults, additionally restrict that show_pte() is called only when the addr is a user-space address (addr < TASK_SIZE). This is because the lock of tsk->mm only protects the virtual memory of user address space, furthermore, dumping the page tables of a kernel-space address for user faults is unnecessary and may have security implications. Keep everything unchanged for kernel faults, because the kernel is already in the "oops" state, acquiring a lock may risk a deadlock. Co-developed-by: Qi Xi Fixes: 6d021b724481 ("ARM: dump pgd, pmd and pte states on unhandled data abort faults") Link: https://lore.kernel.org/20260716014022.2823-1-xieyuanbin1@huawei.com Acked-by: Lorenzo Stoakes (ARM) Reviewed-by: Linus Walleij Signed-off-by: Qi Xi Signed-off-by: Xie Yuanbin Signed-off-by: Russell King --- scripts/stackdelta | 60 ++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100755 scripts/stackdelta (limited to 'scripts/stackdelta') diff --git a/scripts/stackdelta b/scripts/stackdelta new file mode 100755 index 000000000..44d2dfd62 --- /dev/null +++ b/scripts/stackdelta @@ -0,0 +1,60 @@ +#!/usr/bin/env perl +# SPDX-License-Identifier: GPL-2.0 + +# Read two files produced by the stackusage script, and show the +# delta between them. +# +# Currently, only shows changes for functions listed in both files. We +# could add an option to show also functions which have vanished or +# appeared (which would often be due to gcc making other inlining +# decisions). +# +# Another possible option would be a minimum absolute value for the +# delta. +# +# A third possibility is for sorting by delta, but that can be +# achieved by piping to sort -k5,5g. + +sub read_stack_usage_file { + my %su; + my $f = shift; + open(my $fh, '<', $f) + or die "cannot open $f: $!"; + while (<$fh>) { + chomp; + my ($file, $func, $size, $type) = split; + # Old versions of gcc (at least 4.7) have an annoying quirk in + # that a (static) function whose name has been changed into + # for example ext4_find_unwritten_pgoff.isra.11 will show up + # in the .su file with a name of just "11". Since such a + # numeric suffix is likely to change across different + # commits/compilers/.configs or whatever else we're trying to + # tweak, we can't really track those functions, so we just + # silently skip them. + # + # Newer gcc (at least 5.0) report the full name, so again, + # since the suffix is likely to change, we strip it. + next if $func =~ m/^[0-9]+$/; + $func =~ s/\..*$//; + # Line numbers are likely to change; strip those. + $file =~ s/:[0-9]+$//; + $su{"${file}\t${func}"} = {size => $size, type => $type}; + } + close($fh); + return \%su; +} + +@ARGV == 2 + or die "usage: $0 "; + +my $old = read_stack_usage_file($ARGV[0]); +my $new = read_stack_usage_file($ARGV[1]); +my @common = sort grep {exists $new->{$_}} keys %$old; +for (@common) { + my $x = $old->{$_}{size}; + my $y = $new->{$_}{size}; + my $delta = $y - $x; + if ($delta) { + printf "%s\t%d\t%d\t%+d\n", $_, $x, $y, $delta; + } +} -- cgit v1.3.1