[PATCH] mm/hmm: reject shadow-stack mappings

[PATCH] mm/hmm: reject shadow-stack mappings

[Gregory Price (Meta)]

HMM can grant ordinary device write access to a userspace shadow stack.
On x86, pte_write() is true for a shadow-stack PTE, so a populated page
can be returned with HMM_PFN_WRITE without taking a CPU write fault.

Nouveau translates that flag into a writable GPU mapping.

Reject shadow-stack VMAs in hmm_vma_walk_test(). Use the existing
unsupported-range handling: a requested fault returns -EFAULT, while a
snapshot records HMM_PFN_ERROR.

Link: https://lore.kernel.org/linux-mm/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/
Fixes: 54007f818206 ("mm: Introduce VM_SHADOW_STACK for shadow stack memory")
Cc: stable@vger.kernel.org
Cc: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
---
 mm/hmm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/hmm.c b/mm/hmm.c
index 2f1e98c6b644..fa61ca59d927 100644
--- a/mm/hmm.c
+++ b/mm/hmm.c
@@ -596,6 +596,7 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
 	struct vm_area_struct *vma = walk->vma;
 
 	if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)) &&
+	    !vma_test_single_mask(vma, VMA_SHADOW_STACK) &&
 	    vma->vm_flags & VM_READ)
 		return 0;
 
@@ -607,6 +608,8 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
 	 * allow write access either. HMM does not support architectures that
 	 * allow write without read.
 	 *
+	 * Devices must not gain ordinary write access to shadow stacks.
+	 *
 	 * If a fault is requested for an unsupported range then it is a hard
 	 * failure.
 	 */
-- 
2.56.0

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Lorenzo Stoakes (ARM)]

On Fri, Nov 13, 2026 at 02:55:36PM -0500, Gregory Price (Meta) wrote:
> HMM can grant ordinary device write access to a userspace shadow stack.
> On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> can be returned with HMM_PFN_WRITE without taking a CPU write fault.
>
> Nouveau translates that flag into a writable GPU mapping.
>
> Reject shadow-stack VMAs in hmm_vma_walk_test(). Use the existing
> unsupported-range handling: a requested fault returns -EFAULT, while a
> snapshot records HMM_PFN_ERROR.
>
> Link: https://lore.kernel.org/linux-mm/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/
> Fixes: 54007f818206 ("mm: Introduce VM_SHADOW_STACK for shadow stack memory")
> Cc: stable@vger.kernel.org
> Cc: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
> Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>

Thanks for doing the HMM side of this, LGTM and:

Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>

> ---
>  mm/hmm.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/mm/hmm.c b/mm/hmm.c
> index 2f1e98c6b644..fa61ca59d927 100644
> --- a/mm/hmm.c
> +++ b/mm/hmm.c
> @@ -596,6 +596,7 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
>  	struct vm_area_struct *vma = walk->vma;
>
>  	if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)) &&
> +	    !vma_test_single_mask(vma, VMA_SHADOW_STACK) &&
>  	    vma->vm_flags & VM_READ)
>  		return 0;
>
> @@ -607,6 +608,8 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
>  	 * allow write access either. HMM does not support architectures that
>  	 * allow write without read.
>  	 *
> +	 * Devices must not gain ordinary write access to shadow stacks.
> +	 *
>  	 * If a fault is requested for an unsupported range then it is a hard
>  	 * failure.
>  	 */
> --
> 2.56.0
>

--
Cheers, Lorenzo

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[David Hildenbrand (Arm)]

On 11/13/26 20:55, Gregory Price (Meta) wrote:
> HMM can grant ordinary device write access to a userspace shadow stack.
> On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> can be returned with HMM_PFN_WRITE without taking a CPU write fault.
> 
> Nouveau translates that flag into a writable GPU mapping.
> 
> Reject shadow-stack VMAs in hmm_vma_walk_test(). Use the existing
> unsupported-range handling: a requested fault returns -EFAULT, while a
> snapshot records HMM_PFN_ERROR.
> 
> Link: https://lore.kernel.org/linux-mm/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/
> Fixes: 54007f818206 ("mm: Introduce VM_SHADOW_STACK for shadow stack memory")
> Cc: stable@vger.kernel.org
> Cc: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
> Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
> ---
>  mm/hmm.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/mm/hmm.c b/mm/hmm.c
> index 2f1e98c6b644..fa61ca59d927 100644
> --- a/mm/hmm.c
> +++ b/mm/hmm.c
> @@ -596,6 +596,7 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
>  	struct vm_area_struct *vma = walk->vma;
>  
>  	if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)) &&
> +	    !vma_test_single_mask(vma, VMA_SHADOW_STACK) &&
>  	    vma->vm_flags & VM_READ)
>  		return 0;
>  
> @@ -607,6 +608,8 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
>  	 * allow write access either. HMM does not support architectures that
>  	 * allow write without read.
>  	 *
> +	 * Devices must not gain ordinary write access to shadow stacks.
> +	 *
>  	 * If a fault is requested for an unsupported range then it is a hard
>  	 * failure.
>  	 */

Cool, so I can drop

	e27dc0754e3f4 mm/hmm: refuse shadow stack vmas in hmm_range_fault()

:)

Acked-by: David Hildenbrand (Arm) <david@kernel.org>


I used the comment:

+        * Shadow stack VMAs must not be written, and there is no particular
+        * reason to allow read access to shadow stacks from devices, so just
+        * disallow it entirely.
+        *

-- 
Cheers,

David

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Jason Gunthorpe]

On Fri, Nov 13, 2026 at 02:55:36PM -0500, Gregory Price (Meta) wrote:
> HMM can grant ordinary device write access to a userspace shadow stack.
> On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> can be returned with HMM_PFN_WRITE without taking a CPU write fault.

I'm not sure I understand this? The pte is writable but you don't want
only DMA to write to it?

Is there something special on x86 that makes the shadow stack pte
non-writable by the CPU?

A few more words here would help

Regardless, this seems reasonable to me, there is no use case to
write to the shadow stack..

Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>

Jason

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Gregory Price (Meta)]

On 2026-11-13 19:57 +0000, Lorenzo Stoakes (ARM) wrote:
> On Fri, Nov 13, 2026 at 02:55:36PM -0500, Gregory Price (Meta) wrote:
> > HMM can grant ordinary device write access to a userspace shadow stack.
> > On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> > can be returned with HMM_PFN_WRITE without taking a CPU write fault.
> >
> > Nouveau translates that flag into a writable GPU mapping.
> >
> > Reject shadow-stack VMAs in hmm_vma_walk_test(). Use the existing
> > unsupported-range handling: a requested fault returns -EFAULT, while a
> > snapshot records HMM_PFN_ERROR.
> >
> > Link: https://lore.kernel.org/linux-mm/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/
> > Fixes: 54007f818206 ("mm: Introduce VM_SHADOW_STACK for shadow stack memory")
> > Cc: stable@vger.kernel.org
> > Cc: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
> > Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
> 
> Thanks for doing the HMM side of this, LGTM and:
> 

Fell out of my testing harness when reviewing yours :]

Stuff like this is becoming much lower effort than yesteryear.

> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>

thanks!

-- 
~Gregory

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Gregory Price (Meta)]

On 2026-11-13 16:03 -0400, Jason Gunthorpe wrote:
> On Fri, Nov 13, 2026 at 02:55:36PM -0500, Gregory Price (Meta) wrote:
> > HMM can grant ordinary device write access to a userspace shadow stack.
> > On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> > can be returned with HMM_PFN_WRITE without taking a CPU write fault.
> 
> I'm not sure I understand this? The pte is writable but you don't want
> only DMA to write to it?
>
> Is there something special on x86 that makes the shadow stack pte
> non-writable by the CPU?
>

Some of the context is here:
https://lore.kernel.org/all/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/

We had a similar issue with migration, but this should handle the DMA
case as well.

It's "technically writable" but the kernel is supposed to prevent that.

I will say my understanding of the larger HMM picture is limited, so
there might be a better way than special-casing it like this.

-- 
~Gregory

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Gregory Price (Meta)]

On 2026-11-13 21:03 +0100, David Hildenbrand (Arm) wrote:
> On 11/13/26 20:55, Gregory Price (Meta) wrote:
> Cool, so I can drop
> 
> 	e27dc0754e3f4 mm/hmm: refuse shadow stack vmas in hmm_range_fault()
> 
> :)
> 

Haven't seen that one :], i suppose *yoink*

> Acked-by: David Hildenbrand (Arm) <david@kernel.org>
> 
> 
> I used the comment:
> 
> +        * Shadow stack VMAs must not be written, and there is no particular
> +        * reason to allow read access to shadow stacks from devices, so just
> +        * disallow it entirely.
> +        *
> 

Seems reasonable, maybe addresses Jason's request for additional
context.

-- 
~Gregory

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[David Hildenbrand (Arm)]

On 11/13/26 21:42, Gregory Price (Meta) wrote:
> On 2026-11-13 21:03 +0100, David Hildenbrand (Arm) wrote:
>> On 11/13/26 20:55, Gregory Price (Meta) wrote:
>> Cool, so I can drop
>>
>> 	e27dc0754e3f4 mm/hmm: refuse shadow stack vmas in hmm_range_fault()
>>
>> :)
>>
> 
> Haven't seen that one :], i suppose *yoink*

Not posted yet, I'm preparing a bigger set again, but I'm happy about anything I
have to drop! :)

-- 
Cheers,

David