From: Nathan Chancellor <nathan@kernel.org>
To: Mike Rapoport <rppt@kernel.org>,
Dave Hansen <dave.hansen@linux.intel.com>
Cc: linux-tip-commits@vger.kernel.org,
Juergen Gross <jgross@suse.com>,
"Lorenzo Stoakes (ARM)" <ljs@kernel.org>,
syzbot@syzkaller.appspotmail.com, Atish Patra <atishp@meta.com>,
Nikunj A Dadhania <nikunj@amd.com>,
stable@vger.kernel.org, x86@kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [tip: x86/urgent] x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()
Date: Fri, 4 Sep 2026 21:42:53 -0700 [thread overview]
Message-ID: <20260905044253.GA3816371@ax162> (raw)
In-Reply-To: <178837401172.3717435.314324339347590321.tip-bot2@tip-bot2>
Hi folks,
On Wed, Sep 02, 2026 at 06:33:31PM -0000, tip-bot2 for Mike Rapoport (Microsoft) wrote:
> The following commit has been merged into the x86/urgent branch of tip:
>
> Commit-ID: 453e7859443446b837d905d6f2983a76c867247d
> Gitweb: https://git.kernel.org/tip/453e7859443446b837d905d6f2983a76c867247d
> Author: Mike Rapoport (Microsoft) <rppt@kernel.org>
> AuthorDate: Thu, 13 Aug 2026 12:01:28 +03:00
> Committer: Dave Hansen <dave.hansen@linux.intel.com>
> CommitterDate: Tue, 01 Sep 2026 15:03:18 -07:00
>
> x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()
>
> lookup_address_in_pgd_attr() accumulates the effective NX and RW bits of
> the walked page table levels so that verify_rwx() can detect mappings that
> are both writable and executable.
>
> The RW bits are folded into a bool with
>
> rw &= pXd_flags(*pXd) & _PAGE_RW;
>
> but _PAGE_RW is 0x2. So consider the accumulation line:
>
> rw &= pXd_flags(*pXd) & _PAGE_RW;
>
> where rw=0x1 and the right side evaluates down to 0x2. It'll end up doing:
>
> rw = 0x1 & 0x2
>
> and rw always ends up 0.
>
> This way rw becomes false at the first level walked, regardless of the
> actual permissions, and verify_rwx() treats every mapping as non-writable
> and never reports a W^X violation.
>
> Add double negation to the right side to normalize the _PAGE_RW flag to
> 0 or 1.
>
> Assisted-by: Copilot:claude-opus-4.8
> Fixes: ceb647b4b529 ("x86/pat: Introduce lookup_address_in_pgd_attr()")
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
> Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
> Reviewed-by: Juergen Gross <jgross@suse.com>
> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>
> Tested-by: syzbot@syzkaller.appspotmail.com
> Tested-by: Atish Patra <atishp@meta.com>
> Tested-by: Nikunj A Dadhania <nikunj@amd.com>
> Cc:stable@vger.kernel.org
> Link: https://patch.msgid.link/20260813-cpa-fixes-v2-5-39b4ff90f91d@kernel.org
> ---
> arch/x86/mm/pat/set_memory.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
> index 4652487..2266609 100644
> --- a/arch/x86/mm/pat/set_memory.c
> +++ b/arch/x86/mm/pat/set_memory.c
> @@ -754,7 +754,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
>
> *level = PG_LEVEL_512G;
> *nx |= pgd_flags(*pgd) & _PAGE_NX;
> - *rw &= pgd_flags(*pgd) & _PAGE_RW;
> + *rw &= !!(pgd_flags(*pgd) & _PAGE_RW);
>
> p4d = p4d_offset(pgd, address);
> if (p4d_none(*p4d))
> @@ -765,7 +765,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
>
> *level = PG_LEVEL_1G;
> *nx |= p4d_flags(*p4d) & _PAGE_NX;
> - *rw &= p4d_flags(*p4d) & _PAGE_RW;
> + *rw &= !!(p4d_flags(*p4d) & _PAGE_RW);
>
> pud = pud_offset(p4d, address);
> if (pud_none(*pud))
> @@ -776,7 +776,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
>
> *level = PG_LEVEL_2M;
> *nx |= pud_flags(*pud) & _PAGE_NX;
> - *rw &= pud_flags(*pud) & _PAGE_RW;
> + *rw &= !!(pud_flags(*pud) & _PAGE_RW);
>
> pmd = pmd_offset(pud, address);
> if (pmd_none(*pmd))
> @@ -787,7 +787,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned long address,
>
> *level = PG_LEVEL_4K;
> *nx |= pmd_flags(*pmd) & _PAGE_NX;
> - *rw &= pmd_flags(*pmd) & _PAGE_RW;
> + *rw &= !!(pmd_flags(*pmd) & _PAGE_RW);
>
> return pte_offset_kernel(pmd, address);
> }
I just bisected the following warning on a couple of my test machines to
commit 453e78594434 ("x86/mm/pat: Fix effective RW computation in
lookup_address_in_pgd_attr()") in next-20260904.
[Sep 4 21:36] CPA detected W^X violation: 8000000000000123 -> 0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 100e00
[ +0.000001] WARNING: arch/x86/mm/pat/set_memory.c:722 at __change_page_attr_set_clr+0xde7/0x1290, CPU#0: swapper/0/0
[ +0.000005] Modules linked in:
[ +0.000002] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1-debug-00006-g453e78594434 #1 PREEMPT(full) 2950d432dd3910251071a66f3134fe0875432786
[ +0.000001] Hardware name: ASUS System Product Name/PRIME Z590M-PLUS, BIOS 1801 12/26/2022
[ +0.000001] RIP: 0010:__change_page_attr_set_clr+0xdff/0x1290
[ +0.000002] Code: 80 7c 24 42 00 0f 85 3a 04 00 00 48 8d 3d 19 8d 79 02 49 89 d9 4c 89 e1 4c 89 d2 4c 89 f6 4d 8d 84 24 ff 0f 00 00 4c 89 14 24 <67> 48 0f b9 3a 4c 8b 14 24 48 8b 0d 81 44 bf 01 41 f6 c2 01 0f 85
[ +0.000001] RSP: 0000:ffffffff87003c60 EFLAGS: 00010246
[ +0.000002] RAX: 0000000000000002 RBX: 0000000000100e00 RCX: ffffffffc0400000
[ +0.000000] RDX: 0000000000000123 RSI: 8000000000000123 RDI: ffffffff872e50c0
[ +0.000001] RBP: 8000000100e00123 R08: ffffffffc0400fff R09: 0000000000100e00
[ +0.000001] R10: 0000000000000123 R11: 0000000000000001 R12: ffffffffc0400000
[ +0.000000] R13: 0000000100e00123 R14: 8000000000000123 R15: ffffffff87003d58
[ +0.000001] FS: 0000000000000000(0000) GS:ffff8ad1777a7000(0000) knlGS:0000000000000000
[ +0.000001] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ +0.000001] CR2: ffff8ad0a4201000 CR3: 00000007e3022001 CR4: 0000000000770ef0
[ +0.000001] PKRU: 55555554
[ +0.000001] Call Trace:
[ +0.000001] <TASK>
[ +0.000002] ? _vm_unmap_aliases+0x219/0x280
[ +0.000003] change_page_attr_set_clr+0x161/0x250
[ +0.000002] ? events_sysfs_show+0x5d/0x80
[ +0.000002] set_memory_x+0x39/0x50
[ +0.000002] apply_retpolines+0x656/0x6d0
[ +0.000002] ? events_sysfs_show+0x5d/0x80
[ +0.000002] ? events_sysfs_show+0x6c/0x80
[ +0.000001] ? events_sysfs_show+0x62/0x80
[ +0.000001] alternative_instructions+0x3c/0xd0
[ +0.000003] arch_cpu_finalize_init+0x130/0x190
[ +0.000003] start_kernel+0x97d/0xa10
[ +0.000002] x86_64_start_reservations+0x24/0x30
[ +0.000002] x86_64_start_kernel+0xda/0xe0
[ +0.000002] common_startup_64+0x13e/0x151
[ +0.000003] </TASK>
[ +0.000001] ---[ end trace 0000000000000000 ]---
# bad: [af5f12805e5cefa4fe68d6127c7e1fb78cd5535c] Add linux-next specific files for 20260904
# good: [421066905cbceca1f78cba5f7d92b4980317ab2b] Merge tag 'probes-fixes-v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
git bisect start 'af5f12805e5cefa4fe68d6127c7e1fb78cd5535c' '421066905cbceca1f78cba5f7d92b4980317ab2b'
# bad: [7e9b8247e9129fa3803020d3262e2384a0cfc29a] Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/hid/hid.git
git bisect bad 7e9b8247e9129fa3803020d3262e2384a0cfc29a
# bad: [c4faef7e83f9c601c1264c0fad20af0e00b5a52b] Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git
git bisect bad c4faef7e83f9c601c1264c0fad20af0e00b5a52b
# good: [14bd0d1671d1655d33419b60c9c476d0590636dd] Merge branch 'drm-fixes' of https://gitlab.freedesktop.org/drm/kernel.git
git bisect good 14bd0d1671d1655d33419b60c9c476d0590636dd
# good: [8d6fa663f11a859304187a70c569ec0617aa2461] Merge https://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm.git mm-unstable into for-next
git bisect good 8d6fa663f11a859304187a70c569ec0617aa2461
# bad: [276cefa1ab31a5d4fe5e4446f5e504499cc03320] Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/mm/linux.git
git bisect bad 276cefa1ab31a5d4fe5e4446f5e504499cc03320
# good: [aad09a60e0012e85b03540a12e1fd1a61646712b] Merge branch 'rust-fixes' of https://github.com/Rust-for-Linux/linux.git
git bisect good aad09a60e0012e85b03540a12e1fd1a61646712b
# bad: [586e57cb2f695099a15e72029804a0592e6ad566] Merge branch into tip/master: 'x86/urgent'
git bisect bad 586e57cb2f695099a15e72029804a0592e6ad566
# good: [223f1750ff141a7e59b2724b645f348ffdab12e9] Merge branch into tip/master: 'sched/urgent'
git bisect good 223f1750ff141a7e59b2724b645f348ffdab12e9
# good: [e679ba0983757e9567aeda97cc35c99241d420ee] x86/alternative: Exclude text poking against change_page_attr()
git bisect good e679ba0983757e9567aeda97cc35c99241d420ee
# bad: [453e7859443446b837d905d6f2983a76c867247d] x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()
git bisect bad 453e7859443446b837d905d6f2983a76c867247d
# good: [0e33126d5def407397deaf617559a1a2a7f4b1ae] x86/mm/pat: Allocate split page tables as kernel page tables
git bisect good 0e33126d5def407397deaf617559a1a2a7f4b1ae
# first 'bad' commit: [453e7859443446b837d905d6f2983a76c867247d] x86/mm/pat: Fix effective RW computation in lookup_address_in_pgd_attr()
If there is any information I can provide to help debug this, I am happy
to provide it.
--
Cheers,
Nathan
next prev parent reply other threads:[~2026-09-05 4:42 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-13 9:01 [PATCH v2 0/5] x86/mm/pat: CPA fixes Mike Rapoport
2026-08-13 9:01 ` [PATCH v2 1/5] x86/mm/pat: acquire init_mm write lock on collapse to avoid UAF Mike Rapoport
2026-08-31 22:27 ` [tip: x86/urgent] x86/mm/pat: Acquire " tip-bot2 for Lorenzo Stoakes (ARM)
2026-09-01 6:03 ` Jiri Slaby
2026-09-01 7:10 ` Lorenzo Stoakes (ARM)
2026-09-01 23:36 ` Dave Hansen
2026-09-02 6:53 ` Lorenzo Stoakes (ARM)
2026-09-08 9:32 ` Mike Rapoport
2026-09-08 10:12 ` Lorenzo Stoakes (ARM)
2026-09-08 13:58 ` Dave Hansen
2026-09-08 15:14 ` Dave Hansen
2026-09-08 15:17 ` Vlastimil Babka (SUSE)
2026-09-08 19:59 ` Dave Hansen
2026-09-08 23:00 ` Update on CPA fixes, x86/urgent and x86/mm Dave Hansen
2026-09-09 6:40 ` Ingo Molnar
2026-09-09 6:45 ` Ingo Molnar
2026-09-02 18:33 ` [tip: x86/urgent] x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF tip-bot2 for Lorenzo Stoakes (ARM)
2026-09-08 7:21 ` [tip: x86/mm] " tip-bot2 for Lorenzo Stoakes (ARM)
2026-09-08 22:51 ` [tip: x86/urgent] " tip-bot2 for Lorenzo Stoakes (ARM)
2026-09-09 6:44 ` tip-bot2 for Lorenzo Stoakes (ARM)
2026-08-13 9:01 ` [PATCH v2 2/5] x86/mm/pat: acquire init_mm read lock on attribute change " Mike Rapoport
2026-08-31 22:27 ` [tip: x86/urgent] x86/mm/pat: Acquire " tip-bot2 for Lorenzo Stoakes (ARM)
2026-09-01 6:05 ` Jiri Slaby
2026-09-01 7:20 ` Lorenzo Stoakes (ARM)
2026-09-01 13:46 ` Dave Hansen
2026-09-02 18:33 ` tip-bot2 for Lorenzo Stoakes (ARM)
2026-09-08 7:21 ` [tip: x86/mm] x86/mm/pat: Acquire init_mm read lock on attribute changes " tip-bot2 for Lorenzo Stoakes (ARM)
2026-09-08 22:51 ` [tip: x86/urgent] " tip-bot2 for Lorenzo Stoakes (ARM)
2026-09-09 6:44 ` tip-bot2 for Lorenzo Stoakes (ARM)
2026-08-13 9:01 ` [PATCH v2 3/5] x86/alternative: exclude text poking against change_page_attr() Mike Rapoport
2026-08-25 9:37 ` Jiri Slaby
2026-08-31 22:27 ` [tip: x86/urgent] x86/alternative: Exclude " tip-bot2 for Pedro Falcato
2026-09-01 6:16 ` Jiri Slaby
2026-09-01 7:18 ` Lorenzo Stoakes (ARM)
2026-09-01 7:22 ` Jiri Slaby
2026-09-01 7:24 ` Lorenzo Stoakes (ARM)
2026-09-02 18:33 ` tip-bot2 for Pedro Falcato
2026-09-08 7:21 ` [tip: x86/mm] x86/alternatives: " tip-bot2 for Pedro Falcato
2026-09-08 22:51 ` [tip: x86/urgent] " tip-bot2 for Pedro Falcato
2026-09-09 6:44 ` tip-bot2 for Pedro Falcato
2026-08-13 9:01 ` [PATCH v2 4/5] x86/mm/pat: allocate split page tables as kernel page tables Mike Rapoport
2026-08-31 22:27 ` [tip: x86/urgent] x86/mm/pat: Allocate " tip-bot2 for Lorenzo Stoakes (ARM)
2026-09-02 18:33 ` tip-bot2 for Lorenzo Stoakes (ARM)
2026-09-08 7:21 ` [tip: x86/mm] " tip-bot2 for Lorenzo Stoakes (ARM)
2026-09-08 22:51 ` [tip: x86/urgent] " tip-bot2 for Lorenzo Stoakes (ARM)
2026-09-09 6:44 ` tip-bot2 for Lorenzo Stoakes (ARM)
2026-08-13 9:01 ` [PATCH v2 5/5] x86/mm/pat: fix effective RW computation in lookup_address_in_pgd_attr() Mike Rapoport (Microsoft)
2026-08-13 9:45 ` Lorenzo Stoakes (ARM)
2026-08-31 22:27 ` [tip: x86/urgent] x86/mm/pat: Fix " tip-bot2 for Mike Rapoport (Microsoft)
2026-09-02 18:33 ` tip-bot2 for Mike Rapoport (Microsoft)
2026-09-05 4:42 ` Nathan Chancellor [this message]
2026-09-06 14:50 ` Dave Hansen
2026-09-06 18:12 ` Nathan Chancellor
2026-09-06 19:12 ` Dave Hansen
2026-09-06 19:52 ` Mike Rapoport
2026-09-07 6:46 ` Mike Rapoport
2026-09-07 22:28 ` Nathan Chancellor
2026-09-08 9:29 ` Mike Rapoport
2026-09-08 22:52 ` [tip: x86/mm] " tip-bot2 for Mike Rapoport (Microsoft)
2026-08-13 15:05 ` [PATCH v2 0/5] x86/mm/pat: CPA fixes Nikunj A. Dadhania
2026-08-13 15:07 ` Lorenzo Stoakes (ARM)
2026-08-13 15:23 ` Pedro Falcato
2026-08-13 17:13 ` Andrew Morton
2026-08-25 7:12 ` Atish Patra
2026-08-25 7:31 ` Lorenzo Stoakes (ARM)
2026-08-25 20:05 ` Atish Patra
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260905044253.GA3816371@ax162 \
--to=nathan@kernel.org \
--cc=atishp@meta.com \
--cc=dave.hansen@linux.intel.com \
--cc=jgross@suse.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-tip-commits@vger.kernel.org \
--cc=ljs@kernel.org \
--cc=nikunj@amd.com \
--cc=rppt@kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot@syzkaller.appspotmail.com \
--cc=x86@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.