Re: [PATCH RFC v2 13/20] x86: mm: carve out the generic compile-time folded pgtable case in effective_prot()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] `effective_prot()` incorrectly stores dummy values from folded page table entries instead of ignoring them, breaking protection inheritance and silently disabling W+X security checks.
--

--- Patch [13]: [PATCH RFC v2 13/20] x86: mm: carve out the generic compile-time folded pgtable case in effective_prot() ---
commit 11eb6cce58717a2c22f41583089bb3b0105af585
Author: David Hildenbrand (Arm) <david@kernel.org>

x86: mm: carve out the generic compile-time folded pgtable case in effective_prot()

This commit introduces ptdump_pt_level_first() to identify the first
real page-table level for compile-time folded page tables. It modifies
effective_prot() to skip updating higher_prot for folded or top-level
entries, aiming to ignore dummy values from folded page table levels.

> diff --git a/arch/x86/mm/dump_pagetables.c b/arch/x86/mm/dump_pagetables.c
> index 2afa7a23340e9..4e545988953a0 100644
> --- a/arch/x86/mm/dump_pagetables.c
> +++ b/arch/x86/mm/dump_pagetables.c
[ ... ]
> @@ -254,7 +255,7 @@ static void effective_prot(struct ptdump_state *pt_st, int level, u64 val)
>  	pgprotval_t prot = val & PTE_FLAGS_MASK;
>  	pgprotval_t effective;
>  
> -	if (level > 0) {
> +	if (level > st->first_level) {
>  		pgprotval_t higher_prot = st->prot_levels[level - 1];
>  
>  		effective = (higher_prot & prot & (_PAGE_USER | _PAGE_RW)) |

[Severity: High]
When dealing with a folded level (where level <= st->first_level), the code
falls through to the else branch (effective = prot). Since folded levels use
a dummy value, prot lacks _PAGE_RW.

When the walker reaches the first real intermediate level, higher_prot reads
this dummy value from st->prot_levels[level - 1]. Since it lacks _PAGE_RW,
won't the bitwise AND clear the _PAGE_RW bit for all subsequent levels?

Could this cause ptdump_check_wx() to evaluate all pages as read-only and
silently pass, hiding W+X security vulnerabilities?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260722-dummy_ptxp3-v2-0-d9e4bad31e0a@arm.com?part=13