Re: [PATCH v17 1/1] arm64: mm: Handle Granule Protection Faults (GPFs)

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Missing untagged_addr() in do_gpf_ptw() causes show_pte() to fail for tagged user addresses.
--

commit 33ff4ae42e692cd124830f34b7d3c5368fce252f
Author: Steven Price <steven.price@arm.com>

arm64: mm: Handle Granule Protection Faults (GPFs)

This commit introduces handlers for Granule Protection Faults (GPFs) which
occur when accessing memory delegated to a realm. It issues a kernel oops
for GPFs on page walks via do_gpf_ptw(), and sends a SIGBUS for non-page
walk faults. It also handles fixups for spurious kernel GPFs.

> diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
> --- a/arch/arm64/mm/fault.c
> +++ b/arch/arm64/mm/fault.c
> @@ -910,6 +910,22 @@ static int do_tag_check_fault(unsigned long far, unsigned long esr,
>  	return 0;
>  }
>  
> +static int do_gpf_ptw(unsigned long far, unsigned long esr, struct pt_regs *regs)
> +{
> +	const struct fault_info *inf = esr_to_fault_info(esr);
> +
> +	die_kernel_fault(inf->name, far, esr, regs);

[Severity: Medium]
Does this code miss untagging the address before passing it to the oops
handler?

If a GPF on a page table walk is triggered by a tagged user pointer, passing
the raw, tagged far value to die_kernel_fault() will prevent the page
table dump from showing up in the panic output.

In die_kernel_fault(), the address is passed to show_pte(addr). When
show_pte() checks is_ttbr0_addr(addr), the lingering memory tag in the
upper byte will cause the address to exceed TASK_SIZE. This makes
show_pte() abort with "address between user and kernel address ranges"
and return without dumping the PTE.

> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907162204.1479401-2-suzuki.poulose@arm.com?part=1