Merge branch 'expand-stack'

This modifies our user mode stack expansion code to always take the
mmap_lock for writing before modifying the VM layout.

It's actually something we always technically should have done, but
because we didn't strictly need it, we were being lazy ("opportunistic"
sounds so much better, doesn't it?) about things, and had this hack in
place where we would extend the stack vma in-place without doing the
proper locking.

And it worked fine.  We just needed to change vm_start (or, in the case
of grow-up stacks, vm_end) and together with some special ad-hoc locking
using the anon_vma lock and the mm->page_table_lock, it all was fairly
straightforward.

That is, it was all fine until Ruihan Li pointed out that now that the
vma layout uses the maple tree code, we *really* don't just change
vm_start and vm_end any more, and the locking really is broken.  Oops.

It's not actually all _that_ horrible to fix this once and for all, and
do proper locking, but it's a bit painful.  We have basically three
different cases of stack expansion, and they all work just a bit
differently:

 - the common and obvious case is the page fault handling. It's actually
   fairly simple and straightforward, except for the fact that we have
   something like 24 different versions of it, and you end up in a maze
   of twisty little passages, all alike.

 - the simplest case is the execve() code that creates a new stack.
   There are no real locking concerns because it's all in a private new
   VM that hasn't been exposed to anybody, but lockdep still can end up
   unhappy if you get it wrong.

 - and finally, we have GUP and page pinning, which shouldn't really be
   expanding the stack in the first place, but in addition to execve()
   we also use it for ptrace(). And debuggers do want to possibly access
   memory under the stack pointer and thus need to be able to expand the
   stack as a special case.

None of these cases are exactly complicated, but the page fault case in
particular is just repeated slightly differently many many times.  And
ia64 in particular has a fairly complicated situation where you can have
both a regular grow-down stack _and_ a special grow-up stack for the
register backing store.

So to make this slightly more manageable, the bulk of this series is to
first create a helper function for the most common page fault case, and
convert all the straightforward architectures to it.

Thus the new 'lock_mm_and_find_vma()' helper function, which ends up
being used by x86, arm, powerpc, mips, riscv, alpha, arc, csky, hexagon,
loongarch, nios2, sh, sparc32, and xtensa.  So we not only convert more
than half the architectures, we now have more shared code and avoid some
of those twisty little passages.

And largely due to this common helper function, the full diffstat of
this series ends up deleting more lines than it adds.

That still leaves eight architectures (ia64, m68k, microblaze, openrisc,
parisc, s390, sparc64 and um) that end up doing 'expand_stack()'
manually because they are doing something slightly different from the
normal pattern.  Along with the couple of special cases in execve() and
GUP.

So there's a couple of patches that first create 'locked' helper
versions of the stack expansion functions, so that there's a obvious
path forward in the conversion.  The execve() case is then actually
pretty simple, and is a nice cleanup from our old "grow-up stackls are
special, because at execve time even they grow down".

The #ifdef CONFIG_STACK_GROWSUP in that code just goes away, because
it's just more straightforward to write out the stack expansion there
manually, instead od having get_user_pages_remote() do it for us in some
situations but not others and have to worry about locking rules for GUP.

And the final step is then to just convert the remaining odd cases to a
new world order where 'expand_stack()' is called with the mmap_lock held
for reading, but where it might drop it and upgrade it to a write, only
to return with it held for reading (in the success case) or with it
completely dropped (in the failure case).

In the process, we remove all the stack expansion from GUP (where
dropping the lock wouldn't be ok without special rules anyway), and add
it in manually to __access_remote_vm() for ptrace().

Thanks to Adrian Glaubitz and Frank Scheiner who tested the ia64 cases.
Everything else here felt pretty straightforward, but the ia64 rules for
stack expansion are really quite odd and very different from everything
else.  Also thanks to Vegard Nossum who caught me getting one of those
odd conditions entirely the wrong way around.

Anyway, I think I want to actually move all the stack expansion code to
a whole new file of its own, rather than have it split up between
mm/mmap.c and mm/memory.c, but since this will have to be backported to
the initial maple tree vma introduction anyway, I tried to keep the
patches _fairly_ minimal.

Also, while I don't think it's valid to expand the stack from GUP, the
final patch in here is a "warn if some crazy GUP user wants to try to
expand the stack" patch.  That one will be reverted before the final
release, but it's left to catch any odd cases during the merge window
and release candidates.

Reported-by: Ruihan Li <lrh2000@pku.edu.cn>
* branch 'expand-stack':
  gup: add warning if some caller would seem to want stack expansion
  mm: always expand the stack with the mmap write lock held
  execve: expand new process stack manually ahead of time
  mm: make find_extend_vma() fail if write lock not held
  powerpc/mm: convert coprocessor fault to lock_mm_and_find_vma()
  mm/fault: convert remaining simple cases to lock_mm_and_find_vma()
  arm/mm: Convert to using lock_mm_and_find_vma()
  riscv/mm: Convert to using lock_mm_and_find_vma()
  mips/mm: Convert to using lock_mm_and_find_vma()
  powerpc/mm: Convert to using lock_mm_and_find_vma()
  arm64/mm: Convert to using lock_mm_and_find_vma()
  mm: make the page fault mmap locking killable
  mm: introduce new 'lock_mm_and_find_vma()' page fault helper

diff --cc arch/arm/Kconfig
index cef741b,9ed7f03..d60b73d
--- 1/arch/arm/Kconfig
--- 2/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@@ -125,8 -124,8 +125,9 @@@ config AR
        select HAVE_SYSCALL_TRACEPOINTS
        select HAVE_UID16
        select HAVE_VIRT_CPU_ACCOUNTING_GEN
 +      select HOTPLUG_CORE_SYNC_DEAD if HOTPLUG_CPU
        select IRQ_FORCED_THREADING
+       select LOCK_MM_AND_FIND_VMA
        select MODULES_USE_ELF_REL
        select NEED_DMA_MAP_STATE
        select OF_EARLY_FLATTREE if OF

diff --cc arch/arm/mm/fault.c
Simple merge

diff --cc arch/arm64/Kconfig
Simple merge

diff --cc arch/arm64/mm/fault.c
Simple merge

diff --cc arch/csky/Kconfig
index 95f1e9b,03e9f66..cf2a6fd
--- 1/arch/csky/Kconfig
--- 2/arch/csky/Kconfig
+++ b/arch/csky/Kconfig
@@@ -96,7 -96,7 +96,8 @@@ config CSK
        select HAVE_REGS_AND_STACK_ACCESS_API
        select HAVE_STACKPROTECTOR
        select HAVE_SYSCALL_TRACEPOINTS
 +      select HOTPLUG_CORE_SYNC_DEAD if HOTPLUG_CPU
+       select LOCK_MM_AND_FIND_VMA
        select MAY_HAVE_SPARSE_IRQ
        select MODULES_USE_ELF_RELA if MODULES
        select OF

diff --cc arch/loongarch/Kconfig
Simple merge

diff --cc arch/mips/Kconfig
Simple merge

diff --cc arch/powerpc/Kconfig
Simple merge

diff --cc arch/riscv/Kconfig
Simple merge

diff --cc arch/sh/Kconfig
Simple merge

diff --cc arch/sparc/Kconfig
Simple merge

diff --cc arch/sparc/mm/fault_64.c
Simple merge

diff --cc arch/x86/Kconfig
index d5c6914,cb10310..b3ebf58
--- 1/arch/x86/Kconfig
--- 2/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@@ -275,10 -274,9 +275,11 @@@ config X8
        select HAVE_UNSTABLE_SCHED_CLOCK
        select HAVE_USER_RETURN_NOTIFIER
        select HAVE_GENERIC_VDSO
 +      select HOTPLUG_PARALLEL                 if SMP && X86_64
        select HOTPLUG_SMT                      if SMP
 +      select HOTPLUG_SPLIT_STARTUP            if SMP && X86_32
        select IRQ_FORCED_THREADING
+       select LOCK_MM_AND_FIND_VMA
        select NEED_PER_CPU_EMBED_FIRST_CHUNK
        select NEED_PER_CPU_PAGE_FIRST_CHUNK
        select NEED_SG_DMA_LENGTH

diff --cc arch/xtensa/Kconfig
Simple merge

diff --cc fs/binfmt_elf.c
Simple merge

diff --cc fs/exec.c
index 25c65b6,b84b4fe..80b8611
--- 1/fs/exec.c
--- 2/fs/exec.c
+++ b/fs/exec.c
@@@ -216,12 -222,12 +222,12 @@@ static struct page *get_arg_page(struc
  
        /*
         * We are doing an exec().  'current' is the process
-        * doing the exec and bprm->mm is the new process's mm.
+        * doing the exec and 'mm' is the new process's mm.
         */
-       mmap_read_lock(bprm->mm);
-       ret = get_user_pages_remote(bprm->mm, pos, 1, gup_flags,
+       ret = get_user_pages_remote(mm, pos, 1,
+                       write ? FOLL_WRITE : 0,
 -                      &page, NULL, NULL);
 +                      &page, NULL);
-       mmap_read_unlock(bprm->mm);
+       mmap_read_unlock(mm);
        if (ret <= 0)
                return NULL;
  

diff --cc include/linux/mm.h
Simple merge

diff --cc mm/Kconfig
Simple merge

diff --cc mm/gup.c
Simple merge

diff --cc mm/memory.c
index 58029fd,5ce82a7..d8a9a77
--- 1/mm/memory.c
--- 2/mm/memory.c
+++ b/mm/memory.c
@@@ -5575,34 -5713,40 +5694,41 @@@ int __access_remote_vm(struct mm_struc
        if (mmap_read_lock_killable(mm))
                return 0;
  
 -      /* We might need to expand the stack to access it */
 -      vma = vma_lookup(mm, addr);
 -      if (!vma) {
 -              vma = expand_stack(mm, addr);
 -              if (!vma)
 -                      return 0;
 -      }
 -
        /* ignore errors, just check how much was successfully transferred */
        while (len) {
 -              int bytes, ret, offset;
 +              int bytes, offset;
                void *maddr;
 -              struct page *page = NULL;
 +              struct vm_area_struct *vma = NULL;
 +              struct page *page = get_user_page_vma_remote(mm, addr,
 +                                                           gup_flags, &vma);
 +
 +              if (IS_ERR_OR_NULL(page)) {
- #ifndef CONFIG_HAVE_IOREMAP_PROT
-                       break;
- #else
-                       int res = 0;
++                      /* We might need to expand the stack to access it */
++                      vma = vma_lookup(mm, addr);
++                      if (!vma) {
++                              vma = expand_stack(mm, addr);
++
++                              /* mmap_lock was dropped on failure */
++                              if (!vma)
++                                      return buf - old_buf;
++
++                              /* Try again if stack expansion worked */
++                              continue;
++                      }
++
  
 -              ret = get_user_pages_remote(mm, addr, 1,
 -                              gup_flags, &page, &vma, NULL);
 -              if (ret <= 0) {
 -#ifndef CONFIG_HAVE_IOREMAP_PROT
 -                      break;
 -#else
                        /*
                         * Check if this is a VM_IO | VM_PFNMAP VMA, which
                         * we can access using slightly different code.
                         */
--                      vma = vma_lookup(mm, addr);
--                      if (!vma)
--                              break;
++                      bytes = 0;
++#ifdef CONFIG_HAVE_IOREMAP_PROT
                        if (vma->vm_ops && vma->vm_ops->access)
-                               res = vma->vm_ops->access(vma, addr, buf,
 -                              ret = vma->vm_ops->access(vma, addr, buf,
--                                                        len, write);
-                       if (res <= 0)
 -                      if (ret <= 0)
--                              break;
-                       bytes = res;
 -                      bytes = ret;
++                              bytes = vma->vm_ops->access(vma, addr, buf,
++                                                          len, write);
  #endif
++                      if (bytes <= 0)
++                              break;
                } else {
                        bytes = len;
                        offset = addr & (PAGE_SIZE-1);

diff --cc mm/mmap.c
Simple merge