From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from canpmsgout04.his.huawei.com (canpmsgout04.his.huawei.com [113.46.200.219]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 069033E3D9C for ; Fri, 26 Jun 2026 07:45:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.219 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782459919; cv=none; b=UGLCKLtpJnoF73tCLprHlQQ/qAuUkcpQj3t2I1bEIU5zTziUsVMhy+Jmn6INhFW+7pLQimrrDzqXxVaqjfKGkw+AayM+iUqNmF4Iplmby9+lAG6aFT3nh5rAhseqEj+wZvsT97QvkvnE4pglgmQPZknAenXyMwOds4Nz9WP4Nfg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782459919; c=relaxed/simple; bh=+JpYeokkVHGgr8Sh13ZZ1Xislh9wY13XWd12Isxab1o=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=d2NG7RipzZ5OzuND4DDQkjeIFUAf2ebs/z6RcQ6yfTKNet+hNN1mKVBBb+Cz9PDxqHa+ut+RLHLOJsHgBSgsExnZD2C7eZxM1Fjx6ahlpNRTEZQDjekeQk1mXqjxOxTpQYUoTmqATIiTvJLoRYa/9Z/EruXa4v+13hRxzLFe2ZA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=1JArXj0b; arc=none smtp.client-ip=113.46.200.219 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="1JArXj0b" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=iNBrekGyMQI+kIgI1pFh/0cIx/ntOCrzkyACl8RJHGA=; b=1JArXj0ba6awOAuYX/oy/WQoF1qxUHF7GszWm2UxwCsRCzC0r/Nvr2MhB4uBt3DoTPkhyYY9i UOe9DAu0+8ntuAzn/dEklz7R9akCKOTYEgUOrahUWxyORfdKPnt5SoTy+5X22CvmuZ8cGdqL5el 0+VgdRz588G5vJg+u9/w66M= Received: from mail.maildlp.com (unknown [172.19.162.140]) by canpmsgout04.his.huawei.com (SkyGuard) with ESMTPS id 4gmnXg2Xl3z1prLC; Fri, 26 Jun 2026 15:36:03 +0800 (CST) Received: from kwepemo200010.china.huawei.com (unknown [7.202.195.178]) by mail.maildlp.com (Postfix) with ESMTPS id DAB9E203C0; Fri, 26 Jun 2026 15:45:11 +0800 (CST) Received: from huawei.com (10.44.142.85) by kwepemo200010.china.huawei.com (7.202.195.178) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.36; Fri, 26 Jun 2026 15:45:11 +0800 From: Qi Xi To: Russell King , Andrew Morton CC: , , Yuanbin Xie , Nanyong Sun , Qi Xi Subject: [PATCH v3 0/2] ARM: mm: fix use-after-free in show_pte() Date: Fri, 26 Jun 2026 15:30:46 +0800 Message-ID: <20260626073048.3595106-1-xiqi2@huawei.com> X-Mailer: git-send-email 2.33.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: kwepems100002.china.huawei.com (7.221.188.206) To kwepemo200010.china.huawei.com (7.202.195.178) This series fixes a use-after-free in show_pte() on 32-bit ARM. show_pte() is called from __do_user_fault() after do_page_fault() has already released mmap_read_lock. If another thread concurrently calls munmap(), the page table pages can be freed while show_pte() is still walking them, causing a use-after-free. Patch 1 fixes the main path (__do_user_fault) with mmap_read_lock(). Patch 2 protects the do_DataAbort() fallback path with mmap_read_trylock(), which enters show_pte() only for rare FSR types (fsr_info entries with fn=do_bad). v3: Split into two patches. v2: Also fix do_DataAbort() fallback path. Qi Xi (2): ARM: mm: fix use-after-free in __do_user_fault() under CONFIG_DEBUG_USER ARM: mm: protect show_pte() in do_DataAbort() fallback path arch/arm/mm/fault.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) -- 2.33.0