From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from canpmsgout08.his.huawei.com (canpmsgout08.his.huawei.com [113.46.200.223]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 07C4D3E3D9E for ; Fri, 26 Jun 2026 07:45:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=113.46.200.223 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782459918; cv=none; b=u+VwChYLzOceEN+gmnBaaaV/ecmM2gQ3em9iHjSaUkmuf5X+Mug0SCTw04+x4W+3Wtsv6Uo6Ciee9HzCJf10FLE9Ht2Hwq9iODeRj8bTrvnqJGn1XQ1apn17cE3Ow6AGr7VPPCnuXcxJBhZU2be/r8UgQFxofj7O2P56Ug7nz90= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782459918; c=relaxed/simple; bh=SOp/YEfpvYsgeYPdumyE9P7I8cLUNlxFj0xuQI6W69Y=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=cjwhMx1TCwzPABeqXSXvlkaOA04UN/lN4k9sFReuwLmc0Jkh/e152ZHtvaFpw37oYZpSHBGUZS4T4FHiTVZMcdSCyZ4Oj+kUbP+XZKf2dW2If6PI8FPE34wkIT+D/yfOLv753LXk+qHmSDCBuWSNrNP4/SnCQvWqRP26LQoiPvw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com; spf=pass smtp.mailfrom=huawei.com; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b=kodSg9mJ; arc=none smtp.client-ip=113.46.200.223 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=huawei.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=huawei.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=huawei.com header.i=@huawei.com header.b="kodSg9mJ" dkim-signature: v=1; a=rsa-sha256; d=huawei.com; s=dkim; c=relaxed/relaxed; q=dns/txt; h=From; bh=8hTXv0nvgR3f6dAOnwVqmFC5yuwSOexIzoY7bs030Cw=; b=kodSg9mJAW5czQGG0LUdtaVlAzOfyDUrKZB7/A7gvGSEnTSoUsDszyNnv0CG98zeGE/0g0tB1 PQdql/EA2d5n49ozAWyKDcxAIWfdwrcHgNRajhtYq/FKi77pA+4QiWyjcJqoExKD+YwlQMcuIb4 hzKE9X77tWdQrJiyyaCxbsE= Received: from mail.maildlp.com (unknown [172.19.163.214]) by canpmsgout08.his.huawei.com (SkyGuard) with ESMTPS id 4gmnXj5cwSzmVCS; Fri, 26 Jun 2026 15:36:05 +0800 (CST) Received: from kwepemo200010.china.huawei.com (unknown [7.202.195.178]) by mail.maildlp.com (Postfix) with ESMTPS id 7FB644056C; Fri, 26 Jun 2026 15:45:12 +0800 (CST) Received: from huawei.com (10.44.142.85) by kwepemo200010.china.huawei.com (7.202.195.178) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.36; Fri, 26 Jun 2026 15:45:12 +0800 From: Qi Xi To: Russell King , Andrew Morton CC: , , Yuanbin Xie , Nanyong Sun , Qi Xi Subject: [PATCH v3 2/2] ARM: mm: protect show_pte() in do_DataAbort() fallback path Date: Fri, 26 Jun 2026 15:30:48 +0800 Message-ID: <20260626073048.3595106-3-xiqi2@huawei.com> X-Mailer: git-send-email 2.33.0 In-Reply-To: <20260626073048.3595106-1-xiqi2@huawei.com> References: <20260626073048.3595106-1-xiqi2@huawei.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain X-ClientProxiedBy: kwepems100002.china.huawei.com (7.221.188.206) To kwepemo200010.china.huawei.com (7.202.195.178) The do_DataAbort() fallback path handles FSR types not serviced by do_page_fault() (fsr_info entries with fn=do_bad). This path also calls show_pte() without holding mmap_read_lock, exposing it to the same use-after-free issue. Since do_DataAbort() is an exception entry point that can be reached from contexts where sleeping is not allowed, use mmap_read_trylock(). If the lock cannot be acquired, the page table dump is skipped. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Suggested-by: Yuanbin Xie Signed-off-by: Qi Xi --- arch/arm/mm/fault.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c index 1f2a85e1fa..0a8fc40afe 100644 --- a/arch/arm/mm/fault.c +++ b/arch/arm/mm/fault.c @@ -638,7 +638,10 @@ do_DataAbort(unsigned long addr, unsigned int fsr, struct pt_regs *regs) pr_alert("8<--- cut here ---\n"); pr_alert("Unhandled fault: %s (0x%03x) at 0x%08lx\n", inf->name, fsr, addr); - show_pte(KERN_ALERT, current->mm, addr); + if (mmap_read_trylock(current->mm)) { + show_pte(KERN_ALERT, current->mm, addr); + mmap_read_unlock(current->mm); + } arm_notify_die("", regs, inf->sig, inf->code, (void __user *)addr, fsr, 0); -- 2.33.0