Re: [PATCH 2/2] arm64: io: Extract user memory type in ioremap_prot()

[Catalin Marinas <catalin.marinas@arm.com>]

On Mon, Feb 23, 2026 at 10:10:11PM +0000, Will Deacon wrote:
> The only caller of ioremap_prot() outside of the generic ioremap()
> implementation is generic_access_phys(), which passes a 'pgprot_t' value
> determined from the user mapping of the target 'pfn' being accessed by
> the kernel. On arm64, the 'pgprot_t' contains all of the non-address
> bits from the pte, including the permission controls, and so we end up
> returning a new user mapping from ioremap_prot() which faults when
> accessed from the kernel on systems with PAN:
> 
>   | Unable to handle kernel read from unreadable memory at virtual address ffff80008ea89000
>   | ...
>   | Call trace:
>   |   __memcpy_fromio+0x80/0xf8
>   |   generic_access_phys+0x20c/0x2b8
>   |   __access_remote_vm+0x46c/0x5b8
>   |   access_remote_vm+0x18/0x30
>   |   environ_read+0x238/0x3e8
>   |   vfs_read+0xe4/0x2b0
>   |   ksys_read+0xcc/0x178
>   |   __arm64_sys_read+0x4c/0x68
> 
> Extract only the memory type from the user 'pgprot_t' in ioremap_prot()
> and assert that we're being passed a user mapping, to protect us against
> any changes in future that may require additional handling. To avoid
> falsely flagging users of ioremap(), provide our own ioremap() macro
> which simply wraps __ioremap_prot().
> 
> Cc: Zeng Heng <zengheng4@huawei.com>
> Cc: Jinjiang Tu <tujinjiang@huawei.com>
> Cc: Catalin Marinas <catalin.marinas@arm.com>
> Fixes: 893dea9ccd08 ("arm64: Add HAVE_IOREMAP_PROT support")
> Reported-by: Jinjiang Tu <tujinjiang@huawei.com>
> Signed-off-by: Will Deacon <will@kernel.org>

Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>