From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DEF2643F0AB for ; Thu, 16 Jul 2026 08:10:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784189430; cv=none; b=Wq0pm901q3YfV6FTokRNjNyAtsZu7OLnS28CPT4MR3O4NkAWBZWmwx+M2LkYcikcuXSb0cfYCfyZs2EtnSWm3m9PwnrqTtdCYgGSz6e6mU/+lATwSlqWVoDZv79oqDdHFsHBG4dEZ4/RC3wXdoyYckokQIfIMMJ32IpcA+AYVt4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784189430; c=relaxed/simple; bh=X/A+BXJK/Oi9s57xzqxm7Vs8pQn5ntJzGBfERNJXmZc=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=k8EyarDQyzfmng7HhB5N2chG+e86dXVDW/e4wJkBoDsQ0YibJsb3dCdtqhcESviRmImG5mQU4Wnx31KLMvtaHeIjfsb8Q9Vb8fNb6RY8A1+2eWl1NulTTBu2xJpZY/wJnsgIb2fzDQZp1pzwcX3/oTX00MxnBOaSNpsH6Op4qpU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=m802xTK/; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="m802xTK/" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D63D31F000E9; Thu, 16 Jul 2026 08:10:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784189428; bh=ve2448if8jnI1ISg4MwPjfi3E1luSV8yfDgyKZjCilw=; h=From:Date:Subject:To:Cc; b=m802xTK/FaiomKrzoAyq3iuPta6H314i3UNu1gkQUKvM+PXXv64WTgq9Lom9r25am JHvEK3TSomsj/yFJYckmRr7v+ymJq01DlZBueetm/sKujXfgpjG2jTgkTjfQwQLznH KzET3trQ1x0hbE3J9BgzV3kAHYrThBf+dp2NjZAmrgeQt88u8zTQ2+rMxm7iklDwBP Ux7MeURCx5fkdeW4CXB+MDLuHXIVCsH/BhwevmWwGPtrDn8ZHM5C5CjISYBoeG8EiT YU5mAPQOzDyuwCnRfDwVRfzUebdWwIVfCow8v2eseAqZxJzLx5/BQnWwtm33e+RPdo NTs6UW5GntDbQ== From: "Mike Rapoport (Microsoft)" Date: Thu, 16 Jul 2026 11:10:23 +0300 Subject: [PATCH] x86/mm/pat: fix effective RW computation in lookup_address_in_pgd_attr() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260716-verify-rwx-fix-v1-1-d8a04854df06@kernel.org> X-B4-Tracking: v=1; b=H4sIAO6RWGoC/yWMQQ6CMBBFr0Jm7cS2ICZexbhoywBjYjEziBjC3 W11+V7+fxsoCZPCpdpAaGHlKWWwhwri6NNAyF1mcMa15mxbXPK+/6C8V+x5xTqY0NV0sq5pIJ+ eQln/gtfbn/UV7hTnUimL4JUwiE9xLGoSHjgdH15nEtj3L3mi3GCSAAAA X-Change-ID: 20260716-verify-rwx-fix-3b0bd3e51244 To: Dave Hansen Cc: Andy Lutomirski , Borislav Petkov , Ingo Molnar , Ingo Molnar , Juergen Gross , "Mike Rapoport (Microsoft)" , "H. Peter Anvin" , Peter Zijlstra , Thomas Gleixner , x86@kernel.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev lookup_address_in_pgd_attr() accumulates the effective NX and RW bits of the walked page table levels so that verify_rwx() can detect mappings that are both writable and executable. The RW bits are folded into a bool with *rw &= pXd_flags(*pXd) & _PAGE_RW; but _PAGE_RW is bit 1 while *rw only ever holds 0 or 1, so the AND is always 0. *rw becomes false at the first level walked, regardless of the actual permissions, and verify_rwx() treats every mapping as non-writable and never reports a W^X violation. Accumulate NX and RW in unsigned long locals in their native bit positions and store the result into the bool outputs once. Fixes: ceb647b4b529 ("x86/pat: Introduce lookup_address_in_pgd_attr()") Assisted-by: Copilot:claude-opus-4.8 Signed-off-by: Mike Rapoport (Microsoft) --- arch/x86/mm/pat/set_memory.c | 58 ++++++++++++++++++++++++++------------------ 1 file changed, 35 insertions(+), 23 deletions(-) diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c index d023a40a1e03..05de76887fd3 100644 --- a/arch/x86/mm/pat/set_memory.c +++ b/arch/x86/mm/pat/set_memory.c @@ -716,57 +716,69 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star * page table levels. */ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address, - unsigned int *level, bool *nx, bool *rw) + unsigned int *level, + bool *ret_nx, bool *ret_rw) { + unsigned long rw = _PAGE_RW; + unsigned long nx = 0; + pte_t *pte = NULL; p4d_t *p4d; pud_t *pud; pmd_t *pmd; *level = PG_LEVEL_256T; - *nx = false; - *rw = true; - if (pgd_none(*pgd)) - return NULL; + goto out; *level = PG_LEVEL_512G; - *nx |= pgd_flags(*pgd) & _PAGE_NX; - *rw &= pgd_flags(*pgd) & _PAGE_RW; + nx |= pgd_flags(*pgd) & _PAGE_NX; + rw &= pgd_flags(*pgd) & _PAGE_RW; p4d = p4d_offset(pgd, address); if (p4d_none(*p4d)) - return NULL; + goto out; - if (p4d_leaf(*p4d) || !p4d_present(*p4d)) - return (pte_t *)p4d; + if (p4d_leaf(*p4d) || !p4d_present(*p4d)) { + pte = (pte_t *)p4d; + goto out; + } *level = PG_LEVEL_1G; - *nx |= p4d_flags(*p4d) & _PAGE_NX; - *rw &= p4d_flags(*p4d) & _PAGE_RW; + nx |= p4d_flags(*p4d) & _PAGE_NX; + rw &= p4d_flags(*p4d) & _PAGE_RW; pud = pud_offset(p4d, address); if (pud_none(*pud)) - return NULL; + goto out; - if (pud_leaf(*pud) || !pud_present(*pud)) - return (pte_t *)pud; + if (pud_leaf(*pud) || !pud_present(*pud)) { + pte = (pte_t *)pud; + goto out; + } *level = PG_LEVEL_2M; - *nx |= pud_flags(*pud) & _PAGE_NX; - *rw &= pud_flags(*pud) & _PAGE_RW; + nx |= pud_flags(*pud) & _PAGE_NX; + rw &= pud_flags(*pud) & _PAGE_RW; pmd = pmd_offset(pud, address); if (pmd_none(*pmd)) - return NULL; + goto out; - if (pmd_leaf(*pmd) || !pmd_present(*pmd)) - return (pte_t *)pmd; + if (pmd_leaf(*pmd) || !pmd_present(*pmd)) { + pte = (pte_t *)pmd; + goto out; + } *level = PG_LEVEL_4K; - *nx |= pmd_flags(*pmd) & _PAGE_NX; - *rw &= pmd_flags(*pmd) & _PAGE_RW; + nx |= pmd_flags(*pmd) & _PAGE_NX; + rw &= pmd_flags(*pmd) & _PAGE_RW; + pte = pte_offset_kernel(pmd, address); + +out: + *ret_nx = !!nx; + *ret_rw = !!rw; - return pte_offset_kernel(pmd, address); + return pte; } /* --- base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa change-id: 20260716-verify-rwx-fix-3b0bd3e51244 -- Sincerely yours, Mike.