CVE-2026-98923: arm64: io: Reject non-user protection in ioremap_prot()

In the Linux kernel, the following vulnerability has been resolved:

arm64: io: Reject non-user protection in ioremapprot()

Mapping a stack-top page via /dev/mem with PROTNONE and then reading that process's /proc/<pid>/cmdline triggers a spurious WARN in ioremapprot() through genericaccessphys():

WARNING: ./arch/arm64/include/asm/io.h:275 at genericaccessphys Call trace: genericaccessphys+0x1c8/0x228 (P) accessremotevm+0x2b4/0x398 accessremotevm+0x14/0x30 getmmcmdline+0xf8/0x2a0 procpidcmdlineread+0x68/0x120

genericaccessphys() passes the protection derived from the user PTE to ioremapprot(). On arm64, a PROTNONE mapping is represented by a present-invalid PTE, so ptepresent() still returns true and the protection reaches ioremapprot().

A PROTNONE mapping does not have PTEUSER, causing the existing WARNONONCE() in ioremapprot() to fire even though this is a valid user mapping. Execute-only mappings have the same issue and must not be readable through this path either.

ioremapprot() should therefore reject protection values without PTEUSER without warning. This makes the access fail cleanly for PROTNONE and execute-only mappings while retaining the existing user-protection contract.