From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mta1.migadu.com (out-166.mta1.migadu.com [95.215.58.166]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3CD543B2D39 for ; Mon, 19 Oct 2026 13:21:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.166 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792416072; cv=none; b=D1ZHeFP3scBPM3appa/XGuUfZvQDwvikffDiU7wDIBYPa6GFKh0QoSpoiokkcnN5WwWD+ZTt2PTcjV9cSRjVSiM14ZIxMQBrwuuNJMyNbYvXyApi7NVtfLF9Q6K52bfPGDW9txNYJfCjEgUi2EPrSexFFvJuidTEXjXNiCArGFg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792416072; c=relaxed/simple; bh=oEZCYVkZJ7MChk8kB7z/mT2HN0rQx4gixCr14FuhrgU=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=nR6MuF76rJPnZT/s6ZZLXYGvaS/NhyMWg/kUY9CDunKpCaibV3HbT38ouZtajNJOHkpxyJjRipUsh/wJVL2oWHueeyyM7jYZJQLenFFRgoDyyWNVyVzZkswUtedzan704mK0xdDBg4/FZhp+wn0oqLFycQoTptRxQopcxL9jCyk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=ZXK876BH; arc=none smtp.client-ip=95.215.58.166 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="ZXK876BH" X-Envelope-To: linux-kernel@vger.kernel.org DKIM-Signature: a=rsa-sha256; bh=oEZCYVkZJ7MChk8kB7z/mT2HN0rQx4gixCr14FuhrgU=; c=simple/simple; d=linux.dev; h=from:to:subject:date:message-id:mime-version:content-type; s=key1; t=1792416068; v=1; x=1793020868; b=ZXK876BHPFVFjmyvGvZZKOolO+1JJMeRpgnbU6eMKaRB3zyKBpf2bVK1Ic9Vf9w1vd0lrm20 EKXdbSvkxXzDSp+by9U9gGQW6VVzc+1UuVKxd2w0MHWGIKcbagfAKC2VhSYXJj0wh6SlWXvgv/i qYziRzD1kw/db8f+DsXInm1U= X-Envelope-To: linux-kernel@vger.kernel.org Received: by smtp.migadu.com with ESMTPS id 8616446d7d753be6; Mon, 19 Oct 2026 13:21:07 +0000 X-Mizu-Trace-ID: 8616446d7d753be6 X-Migadu-Flow: FLOW_OUT From: Fuad Tabba To: Marc Zyngier , Oliver Upton , kvmarm@lists.linux.dev, linux-arm-kernel@lists.infradead.org Cc: Joey Gouly , Suzuki K Poulose , Zenghui Yu , Steffen Eiden , Catalin Marinas , Will Deacon , Mark Rutland , Steven Price , Yang Shi , David Hildenbrand , Fuad Tabba , linux-kernel@vger.kernel.org Subject: [PATCH 0/3] KVM: arm64: Fix stale MTE tags reaching a guest Date: Mon, 19 Oct 2026 14:21:00 +0100 Message-ID: <20261019132103.3836646-1-fuad.tabba@linux.dev> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Hi folks, Three fixes for hugetlb and THP pages that reach an MTE guest without their tags cleared, so the guest can read whatever tags the pages' previous owners left. The first clears the whole of a hugetlb folio before marking it tagged, rather than only the pages being mapped. The second does the same when KVM_ARM_MTE_COPY_TAGS copies tags into a page. The third sanitises when a permission fault installs a THP block, and runs the VM_MTE_ALLOWED check on permission faults too. A VMM that maps guest memory with PROT_MTE isn't affected, as faulting that memory into its mapping clears the tags first. QEMU and kvmtool map it without. I have a reproducer that reads the previous owner's tag from 511 of 512 pages in each case. With any one patch applied, it reads none in that patch's case. Based on Linux 7.3-rc3 (fd73f4a665989; also applies to kvmarm/next dd0bc00e3e920 with a three-way merge). Cheers, /fuad Fuad Tabba (3): KVM: arm64: Clear the whole hugetlb folio when sanitising MTE tags KVM: arm64: Clear the whole hugetlb folio when storing MTE tags KVM: arm64: Sanitise MTE tags when a permission fault installs a mapping arch/arm64/kvm/guest.c | 11 +++++++---- arch/arm64/kvm/mmu.c | 7 ++++--- 2 files changed, 11 insertions(+), 7 deletions(-) base-commit: fd73f4a6659897191fa0d40695fe370925dd3780 -- 2.47.3