[PATCH] arm64: io: Reject present-invalid user prot in ioremap_prot()

[Zeng Heng]

Hi all,

    Kindly ping.


On 2026/9/5 11:31, Zeng Heng wrote:
> From: Zeng Heng <zengheng4 at huawei.com>
> 
> Mapping a stack-top page via /dev/mem with PROT_NONE and then reading
> that process's /proc/<pid>/cmdline triggers a spurious WARN in
> ioremap_prot() through generic_access_phys():
> 
>    WARNING: ./arch/arm64/include/asm/io.h:275 at generic_access_phys
>    Call trace:
>      generic_access_phys+0x1c8/0x228 (P)
>      __access_remote_vm+0x2b4/0x398
>      access_remote_vm+0x14/0x30
>      get_mm_cmdline+0xf8/0x2a0
>      proc_pid_cmdline_read+0x68/0x120
> 
> generic_access_phys() passes the full pgprot derived from the user PTE
> to ioremap_prot(). A PROT_NONE /dev/mem mapping is encoded as PAGE_NONE,
> which clears PTE_VALID and sets the software PTE_PRESENT_INVALID bit.
> On arm64 such an entry is still pte_present(), so follow_pfnmap_start()
> reports the pfn and generic_access_phys() reaches ioremap_prot().
> The PTE_USER assertion, which is meant to catch kernel prots being
> passed by mistake, then fires for a PROT_NONE user mapping
> that legitimately lacks PTE_USER, producing the spurious WARN.
> 
> Reject a user prot encoding a present-invalid (i.e. PROT_NONE) entry up
> front so that generic_access_phys() cleanly fails the access instead
> of warning. Note that PTE_PRESENT_INVALID aliases the PTE_NG bit and
> is only meaningful when PTE_VALID is clear, so both bits must be
> checked together.
> 
> Fixes: 8f098037139b ("arm64: io: Extract user memory type in ioremap_prot()")
> Signed-off-by: Zeng Heng <zengheng4 at huawei.com>
> ---
>   arch/arm64/include/asm/io.h | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/arch/arm64/include/asm/io.h b/arch/arm64/include/asm/io.h
> index 21c8e400107c..bbfbc4682639 100644
> --- a/arch/arm64/include/asm/io.h
> +++ b/arch/arm64/include/asm/io.h
> @@ -272,6 +272,10 @@ static inline void __iomem *ioremap_prot(phys_addr_t phys, size_t size,
>   	pgprot_t prot;
>   	ptval_t user_prot_val = pgprot_val(user_prot);
>   
> +	if ((user_prot_val & (PTE_VALID | PTE_PRESENT_INVALID)) ==
> +	     PTE_PRESENT_INVALID)
> +		return NULL;
> +
>   	if (WARN_ON_ONCE(!(user_prot_val & PTE_USER)))
>   		return NULL;
>