From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from out-181.mta1.migadu.com (out-181.mta1.migadu.com [95.215.58.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F07AD313E31 for ; Fri, 26 Jun 2026 04:22:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=95.215.58.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782447744; cv=none; b=qROKTzdybzq4i1+IXJV4YLerMjiYPXy0QOBwDFt+JQkZZMpcshHQbvRfduO40B7lxZfvx6eRbJhcYXvjid7RMIeXWAf9brezFCpSSi/w7oaBEvzC/vt8h050dFq8GLe3hLPIwQu3uSxH+wJZ0uMGCOzgbmoxxTxr7ewCCIUZdc0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782447744; c=relaxed/simple; bh=kcsmG8Mw/oYYh6rJj7CyaO4AxOG05/Psv6R4sY96bEY=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc: Message-Id:References:To; b=G7NtPGGQgpVM2i4evlMbfbXs7XXAW3Ho+bUZlNpR/RxNgaG00LkjdVpXx7pDoKetWPcnB7mdgfcZg4QUpLmqO3g/ukEA4dyp33wkRkfkqlKpmMhRa15WYnXZu9P9leForw+myFxbjEGr+lP358P0pnHeRreWYcl4qvLXnQhi9Y4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=Ha3ajxW4; arc=none smtp.client-ip=95.215.58.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="Ha3ajxW4" Content-Type: text/plain; charset=us-ascii DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1782447740; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Y2iZYrcehiloQezHa6L5Jbel2ruqJBtvciYwuV6POaA=; b=Ha3ajxW4nnYDyhVmnrf9lafZACH1Ca4ev+9lzJsUjv0qelwqbz9PObGw3bhuRGHrkLm/pZ 79h53E4Jvsh5z8nD0jBfU3ayLKxumiHx8JIUsyzQb5P6fj6X8F8aTGR8r3+d0LRjJoZVIO EkPh1ok4IJiJykubG+jxxxb1yRXfrn4= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\)) Subject: Re: [PATCH 5/5] mm/mprotect: use huge_ptep_get() for hugetlb X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. From: Muchun Song In-Reply-To: Date: Fri, 26 Jun 2026 12:21:00 +0800 Cc: riel@surriel.com, vbabka@kernel.org, harry@kernel.org, jannh@google.com, lance.yang@linux.dev, kas@kernel.org, linux-mm@kvack.org, linux-kernel@vger.kernel.org, rcampbell@nvidia.com, apopple@nvidia.com, ziy@nvidia.com, matthew.brost@intel.com, joshua.hahnjy@gmail.com, rakie.kim@sk.com, byungchul@sk.com, gourry@gourry.net, ying.huang@linux.alibaba.com, mel@csn.ul.ie, nao.horiguchi@gmail.com, ak@linux.intel.com, j-nomura@ce.jp.nec.com, pfalcato@suse.de, dave.hansen@intel.com, tglx@kernel.org, jpoimboe@kernel.org, ryan.roberts@arm.com, anshuman.khandual@arm.com, osalvador@suse.de, akpm@linux-foundation.org, ljs@kernel.org, david@kernel.org, liam@infradead.org Content-Transfer-Encoding: quoted-printable Message-Id: References: <20260625112955.3254283-1-dev.jain@arm.com> <20260625112955.3254283-6-dev.jain@arm.com> <28f75d0d-de54-43a1-b46a-fe3dd1188929@linux.dev> To: Dev Jain X-Migadu-Flow: FLOW_OUT > On Jun 26, 2026, at 12:08, Dev Jain wrote: >=20 >=20 >=20 > On 26/06/26 9:10 am, Muchun Song wrote: >>=20 >>=20 >> On 2026/6/25 19:29, Dev Jain wrote: >>> prot_none_hugetlb_entry() is the hugetlb callback for the early >>> mprotect(PROT_NONE) PFN permission walk on x86. >>>=20 >>> The callback passes the decoded PFN to pfn_modify_allowed(). For a >>> hugetlb callback, the pte pointer refers to a hugetlb entry. On >>> architectures where hugetlb entries need huge_ptep_get(), reading = that >>> entry with ptep_get() can make the permission check use the wrong = PFN. >>>=20 >>> Use huge_ptep_get() before decoding the hugetlb PFN. >>>=20 >>> Currently there is no path which can trigger a bug: huge_ptep_get() = is a >>> simple ptep_get() for x86, and the prot_none walk occurs only for = x86. >>> But use the correct helper anyways. >>>=20 >>> Fixes: 42e4089c7890 ("x86/speculation/l1tf: Disallow non privileged = high MMIO PROT_NONE mappings") >>> Signed-off-by: Dev Jain >>> --- >>> mm/mprotect.c | 8 +++++++- >>> 1 file changed, 7 insertions(+), 1 deletion(-) >>>=20 >>> diff --git a/mm/mprotect.c b/mm/mprotect.c >>> index 9cbf932b028cf..23779632d18bf 100644 >>> --- a/mm/mprotect.c >>> +++ b/mm/mprotect.c >>> @@ -699,14 +699,20 @@ static int prot_none_pte_entry(pte_t *pte, = unsigned long addr, >>> 0 : -EACCES; >>> } >>> +#ifdef CONFIG_HUGETLB_PAGE >>> static int prot_none_hugetlb_entry(pte_t *pte, unsigned long = hmask, >>> unsigned long addr, unsigned long next, >>> struct mm_walk *walk) >>> { >>> - return pfn_modify_allowed(pte_pfn(ptep_get(pte)), >>> + pte_t entry =3D huge_ptep_get(walk->mm, addr, pte); >>> + >>> + return pfn_modify_allowed(pte_pfn(entry), >>> *(pgprot_t *)(walk->private)) ? >>> 0 : -EACCES; >>> } >>> +#else >>> +#define prot_none_hugetlb_entry NULL >>=20 >> This is very strange, because we defined a stub as NULL for a helper >=20 > I was following pattern elsewhere, search for ".hugetlb_entry" in the > codebase and you will find others doing the same. Okay, I understand why you want to do it that way, but I would still recommend not following that format. Thanks. >=20 >=20 >> function. How about the following diff? >>=20 >> diff --git a/mm/mprotect.c b/mm/mprotect.c >> index 9cbf932b028c..4d8c1551fbce 100644 >> --- a/mm/mprotect.c >> +++ b/mm/mprotect.c >> @@ -716,7 +716,9 @@ static int prot_none_test(unsigned long addr, = unsigned long next, >>=20 >> static const struct mm_walk_ops prot_none_walk_ops =3D { >> .pte_entry =3D prot_none_pte_entry, >> +#ifdef CONFIG_HUGETLB_PAGE >> .hugetlb_entry =3D prot_none_hugetlb_entry, >> +#endif >> .test_walk =3D prot_none_test, >> .walk_lock =3D PGWALK_WRLOCK, >> }; >>=20 >> Thanks, >> Muchun >>=20 >>> +#endif >>> static int prot_none_test(unsigned long addr, unsigned long = next, >>> struct mm_walk *walk)