[PATCH] arm64: mm: Stop using the previous ASID for init_mm

[Lai Jiangshan <jiangshanlai@gmail.com>]

From: Lai Jiangshan <jiangshan.ljs@antgroup.com>

Switching to init_mm should prevent further accesses through the
previous address space's translations.

Commit e53f21bce4d3 ("arm64: Use the reserved TTBR0 if context switching
to the init_mm") avoided installing init_mm.pgd as a user page table.
At the time, the ASID was held in TTBR0, so installing the reserved
TTBR0 also switched to ASID 0.

Since commit 7655abb95386 ("arm64: mm: Move ASID from TTBR0 to TTBR1"),
installing the reserved TTBR0 no longer changes the active ASID.
Consequently, switching to init_mm leaves the CPU using the previous
address space's ASID. An empty page table does not prevent TLB hits
for that ASID.

This can retain access beyond the lifetime of the backing pages.
During fullmm teardown, user data pages can be freed before their
cached translations are invalidated. If those pages are subsequently
reused for kernel data, an erroneous uaccess that hits a surviving
translation can read or corrupt that data instead of faulting.

Fixes: 7655abb95386 ("arm64: mm: Move ASID from TTBR0 to TTBR1")
Signed-off-by: Lai Jiangshan <jiangshan.ljs@antgroup.com>

diff --git a/arch/arm64/include/asm/mmu_context.h b/arch/arm64/include/asm/mmu_context.h
index 803b68758152..7e56099c5fbb 100644
--- a/arch/arm64/include/asm/mmu_context.h
+++ b/arch/arm64/include/asm/mmu_context.h
@@ -235,15 +235,6 @@ enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
 
 static inline void __switch_mm(struct mm_struct *next)
 {
-	/*
-	 * init_mm.pgd does not contain any user mappings and it is always
-	 * active for kernel addresses in TTBR1. Just set the reserved TTBR0.
-	 */
-	if (next == &init_mm) {
-		cpu_set_reserved_ttbr0();
-		return;
-	}
-
 	check_and_switch_context(next);
 }
 
diff --git a/arch/arm64/mm/context.c b/arch/arm64/mm/context.c
index 0f4a28b87469..a96ebe904dd7 100644
--- a/arch/arm64/mm/context.c
+++ b/arch/arm64/mm/context.c
@@ -218,6 +218,16 @@ void check_and_switch_context(struct mm_struct *mm)
 	unsigned int cpu;
 	u64 asid, old_active_asid;
 
+	/*
+	 * init_mm.pgd contains kernel mappings, so use the reserved page
+	 * tables for TTBR0 and switch TTBR1 to ASID 0. Leave active_asids
+	 * unchanged to preserve the ASID rollover bookkeeping.
+	 */
+	if (mm == &init_mm) {
+		cpu_do_switch_mm(__pa_symbol(reserved_pg_dir), mm);
+		return;
+	}
+
 	if (system_supports_cnp())
 		cpu_set_reserved_ttbr0();
 
-- 
2.39.5 (Apple Git-154)