[PATCH] mm/hmm: reject shadow-stack mappings

[PATCH] mm/hmm: reject shadow-stack mappings

[Gregory Price (Meta)]

HMM can grant ordinary device write access to a userspace shadow stack.
On x86, pte_write() is true for a shadow-stack PTE, so a populated page
can be returned with HMM_PFN_WRITE without taking a CPU write fault.

Nouveau translates that flag into a writable GPU mapping.

Reject shadow-stack VMAs in hmm_vma_walk_test(). Use the existing
unsupported-range handling: a requested fault returns -EFAULT, while a
snapshot records HMM_PFN_ERROR.

Link: https://lore.kernel.org/linux-mm/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/
Fixes: 54007f818206 ("mm: Introduce VM_SHADOW_STACK for shadow stack memory")
Cc: stable@vger.kernel.org
Cc: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
---
 mm/hmm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/mm/hmm.c b/mm/hmm.c
index 2f1e98c6b644..fa61ca59d927 100644
--- a/mm/hmm.c
+++ b/mm/hmm.c
@@ -596,6 +596,7 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
 	struct vm_area_struct *vma = walk->vma;
 
 	if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)) &&
+	    !vma_test_single_mask(vma, VMA_SHADOW_STACK) &&
 	    vma->vm_flags & VM_READ)
 		return 0;
 
@@ -607,6 +608,8 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
 	 * allow write access either. HMM does not support architectures that
 	 * allow write without read.
 	 *
+	 * Devices must not gain ordinary write access to shadow stacks.
+	 *
 	 * If a fault is requested for an unsupported range then it is a hard
 	 * failure.
 	 */
-- 
2.56.0

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Lorenzo Stoakes (ARM)]

On Fri, Nov 13, 2026 at 02:55:36PM -0500, Gregory Price (Meta) wrote:
> HMM can grant ordinary device write access to a userspace shadow stack.
> On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> can be returned with HMM_PFN_WRITE without taking a CPU write fault.
>
> Nouveau translates that flag into a writable GPU mapping.
>
> Reject shadow-stack VMAs in hmm_vma_walk_test(). Use the existing
> unsupported-range handling: a requested fault returns -EFAULT, while a
> snapshot records HMM_PFN_ERROR.
>
> Link: https://lore.kernel.org/linux-mm/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/
> Fixes: 54007f818206 ("mm: Introduce VM_SHADOW_STACK for shadow stack memory")
> Cc: stable@vger.kernel.org
> Cc: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
> Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>

Thanks for doing the HMM side of this, LGTM and:

Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>

> ---
>  mm/hmm.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/mm/hmm.c b/mm/hmm.c
> index 2f1e98c6b644..fa61ca59d927 100644
> --- a/mm/hmm.c
> +++ b/mm/hmm.c
> @@ -596,6 +596,7 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
>  	struct vm_area_struct *vma = walk->vma;
>
>  	if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)) &&
> +	    !vma_test_single_mask(vma, VMA_SHADOW_STACK) &&
>  	    vma->vm_flags & VM_READ)
>  		return 0;
>
> @@ -607,6 +608,8 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
>  	 * allow write access either. HMM does not support architectures that
>  	 * allow write without read.
>  	 *
> +	 * Devices must not gain ordinary write access to shadow stacks.
> +	 *
>  	 * If a fault is requested for an unsupported range then it is a hard
>  	 * failure.
>  	 */
> --
> 2.56.0
>

--
Cheers, Lorenzo

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[David Hildenbrand (Arm)]

On 11/13/26 20:55, Gregory Price (Meta) wrote:
> HMM can grant ordinary device write access to a userspace shadow stack.
> On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> can be returned with HMM_PFN_WRITE without taking a CPU write fault.
> 
> Nouveau translates that flag into a writable GPU mapping.
> 
> Reject shadow-stack VMAs in hmm_vma_walk_test(). Use the existing
> unsupported-range handling: a requested fault returns -EFAULT, while a
> snapshot records HMM_PFN_ERROR.
> 
> Link: https://lore.kernel.org/linux-mm/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/
> Fixes: 54007f818206 ("mm: Introduce VM_SHADOW_STACK for shadow stack memory")
> Cc: stable@vger.kernel.org
> Cc: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
> Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
> ---
>  mm/hmm.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/mm/hmm.c b/mm/hmm.c
> index 2f1e98c6b644..fa61ca59d927 100644
> --- a/mm/hmm.c
> +++ b/mm/hmm.c
> @@ -596,6 +596,7 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
>  	struct vm_area_struct *vma = walk->vma;
>  
>  	if (!(vma->vm_flags & (VM_IO | VM_PFNMAP)) &&
> +	    !vma_test_single_mask(vma, VMA_SHADOW_STACK) &&
>  	    vma->vm_flags & VM_READ)
>  		return 0;
>  
> @@ -607,6 +608,8 @@ static int hmm_vma_walk_test(unsigned long start, unsigned long end,
>  	 * allow write access either. HMM does not support architectures that
>  	 * allow write without read.
>  	 *
> +	 * Devices must not gain ordinary write access to shadow stacks.
> +	 *
>  	 * If a fault is requested for an unsupported range then it is a hard
>  	 * failure.
>  	 */

Cool, so I can drop

	e27dc0754e3f4 mm/hmm: refuse shadow stack vmas in hmm_range_fault()

:)

Acked-by: David Hildenbrand (Arm) <david@kernel.org>


I used the comment:

+        * Shadow stack VMAs must not be written, and there is no particular
+        * reason to allow read access to shadow stacks from devices, so just
+        * disallow it entirely.
+        *

-- 
Cheers,

David

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Jason Gunthorpe]

On Fri, Nov 13, 2026 at 02:55:36PM -0500, Gregory Price (Meta) wrote:
> HMM can grant ordinary device write access to a userspace shadow stack.
> On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> can be returned with HMM_PFN_WRITE without taking a CPU write fault.

I'm not sure I understand this? The pte is writable but you don't want
only DMA to write to it?

Is there something special on x86 that makes the shadow stack pte
non-writable by the CPU?

A few more words here would help

Regardless, this seems reasonable to me, there is no use case to
write to the shadow stack..

Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>

Jason

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Gregory Price (Meta)]

On 2026-11-13 19:57 +0000, Lorenzo Stoakes (ARM) wrote:
> On Fri, Nov 13, 2026 at 02:55:36PM -0500, Gregory Price (Meta) wrote:
> > HMM can grant ordinary device write access to a userspace shadow stack.
> > On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> > can be returned with HMM_PFN_WRITE without taking a CPU write fault.
> >
> > Nouveau translates that flag into a writable GPU mapping.
> >
> > Reject shadow-stack VMAs in hmm_vma_walk_test(). Use the existing
> > unsupported-range handling: a requested fault returns -EFAULT, while a
> > snapshot records HMM_PFN_ERROR.
> >
> > Link: https://lore.kernel.org/linux-mm/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/
> > Fixes: 54007f818206 ("mm: Introduce VM_SHADOW_STACK for shadow stack memory")
> > Cc: stable@vger.kernel.org
> > Cc: "Lorenzo Stoakes (ARM)" <ljs@kernel.org>
> > Signed-off-by: Gregory Price (Meta) <gourry@gourry.net>
> 
> Thanks for doing the HMM side of this, LGTM and:
> 

Fell out of my testing harness when reviewing yours :]

Stuff like this is becoming much lower effort than yesteryear.

> Reviewed-by: Lorenzo Stoakes (ARM) <ljs@kernel.org>

thanks!

-- 
~Gregory

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Gregory Price (Meta)]

On 2026-11-13 16:03 -0400, Jason Gunthorpe wrote:
> On Fri, Nov 13, 2026 at 02:55:36PM -0500, Gregory Price (Meta) wrote:
> > HMM can grant ordinary device write access to a userspace shadow stack.
> > On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> > can be returned with HMM_PFN_WRITE without taking a CPU write fault.
> 
> I'm not sure I understand this? The pte is writable but you don't want
> only DMA to write to it?
>
> Is there something special on x86 that makes the shadow stack pte
> non-writable by the CPU?
>

Some of the context is here:
https://lore.kernel.org/all/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/

We had a similar issue with migration, but this should handle the DMA
case as well.

It's "technically writable" but the kernel is supposed to prevent that.

I will say my understanding of the larger HMM picture is limited, so
there might be a better way than special-casing it like this.

-- 
~Gregory

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Gregory Price (Meta)]

On 2026-11-13 21:03 +0100, David Hildenbrand (Arm) wrote:
> On 11/13/26 20:55, Gregory Price (Meta) wrote:
> Cool, so I can drop
> 
> 	e27dc0754e3f4 mm/hmm: refuse shadow stack vmas in hmm_range_fault()
> 
> :)
> 

Haven't seen that one :], i suppose *yoink*

> Acked-by: David Hildenbrand (Arm) <david@kernel.org>
> 
> 
> I used the comment:
> 
> +        * Shadow stack VMAs must not be written, and there is no particular
> +        * reason to allow read access to shadow stacks from devices, so just
> +        * disallow it entirely.
> +        *
> 

Seems reasonable, maybe addresses Jason's request for additional
context.

-- 
~Gregory

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[David Hildenbrand (Arm)]

On 11/13/26 21:42, Gregory Price (Meta) wrote:
> On 2026-11-13 21:03 +0100, David Hildenbrand (Arm) wrote:
>> On 11/13/26 20:55, Gregory Price (Meta) wrote:
>> Cool, so I can drop
>>
>> 	e27dc0754e3f4 mm/hmm: refuse shadow stack vmas in hmm_range_fault()
>>
>> :)
>>
> 
> Haven't seen that one :], i suppose *yoink*

Not posted yet, I'm preparing a bigger set again, but I'm happy about anything I
have to drop! :)

-- 
Cheers,

David

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Jason Gunthorpe]

On Fri, Nov 13, 2026 at 03:41:33PM -0500, Gregory Price (Meta) wrote:
> On 2026-11-13 16:03 -0400, Jason Gunthorpe wrote:
> > On Fri, Nov 13, 2026 at 02:55:36PM -0500, Gregory Price (Meta) wrote:
> > > HMM can grant ordinary device write access to a userspace shadow stack.
> > > On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> > > can be returned with HMM_PFN_WRITE without taking a CPU write fault.
> > 
> > I'm not sure I understand this? The pte is writable but you don't want
> > only DMA to write to it?
> >
> > Is there something special on x86 that makes the shadow stack pte
> > non-writable by the CPU?
> >
> 
> Some of the context is here:
> https://lore.kernel.org/all/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/
> 
> We had a similar issue with migration, but this should handle the DMA
> case as well.
> 
> It's "technically writable" but the kernel is supposed to prevent that.

Bah, it's not writable at all. The CPU PTE has write disabled and
someone thought it was a good idea to make pte_write() return true
because the CPU allows writes through a special instruction on this
special PTE? So now all the places like this think its writable, when
it really isn't.

You could also fix this by having something like pte_real_write() or
whatever that doesn't lie about the write bit in the PTE :|

The patch is still fine, in that it matches what everything else does,
but I'd include these details someplace..

Jason

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Andrew Morton]

On Fri, 13 Nov 2026 20:20:27 -0400 Jason Gunthorpe <jgg@nvidia.com> wrote:

> On Fri, Nov 13, 2026 at 03:41:33PM -0500, Gregory Price (Meta) wrote:
> > On 2026-11-13 16:03 -0400, Jason Gunthorpe wrote:
> > > On Fri, Nov 13, 2026 at 02:55:36PM -0500, Gregory Price (Meta) wrote:
> > > > HMM can grant ordinary device write access to a userspace shadow stack.
> > > > On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> > > > can be returned with HMM_PFN_WRITE without taking a CPU write fault.
> > > 
> > > I'm not sure I understand this? The pte is writable but you don't want
> > > only DMA to write to it?
> > >
> > > Is there something special on x86 that makes the shadow stack pte
> > > non-writable by the CPU?
> > >
> > 
> > Some of the context is here:
> > https://lore.kernel.org/all/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/
> > 
> > We had a similar issue with migration, but this should handle the DMA
> > case as well.
> > 
> > It's "technically writable" but the kernel is supposed to prevent that.
> 
> Bah, it's not writable at all. The CPU PTE has write disabled and
> someone thought it was a good idea to make pte_write() return true
> because the CPU allows writes through a special instruction on this
> special PTE? So now all the places like this think its writable, when
> it really isn't.
> 
> You could also fix this by having something like pte_real_write() or
> whatever that doesn't lie about the write bit in the PTE :|
> 
> The patch is still fine, in that it matches what everything else does,
> but I'd include these details someplace..

How does this look for an altered changelog?

: On x86, a shadow-stack PTE has its ordinary write bit clear.  The CPU
: rejects ordinary stores to it, but pte_write() reports it writable because
: shadow-stack instructions can write it.  HMM consequently sets
: HMM_PFN_WRITE, which Nouveau turns into ordinary GPU write permission.  A
: process with GPU access can then overwrite its own shadow stack,
: potentially corrupting return addresses or bypassing that protection.
: 
: Reject shadow-stack VMAs in hmm_vma_walk_test(), including read access.  A
: requested fault returns -EFAULT; a snapshot records HMM_PFN_ERROR.

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[Gregory Price (Meta)]

On 2026-11-13 20:20 -0400, Jason Gunthorpe wrote:
> On Fri, Nov 13, 2026 at 03:41:33PM -0500, Gregory Price (Meta) wrote:
> > On 2026-11-13 16:03 -0400, Jason Gunthorpe wrote:
> > > On Fri, Nov 13, 2026 at 02:55:36PM -0500, Gregory Price (Meta) wrote:
> > > > HMM can grant ordinary device write access to a userspace shadow stack.
> > > > On x86, pte_write() is true for a shadow-stack PTE, so a populated page
> > > > can be returned with HMM_PFN_WRITE without taking a CPU write fault.
> > > 
> > > I'm not sure I understand this? The pte is writable but you don't want
> > > only DMA to write to it?
> > >
> > > Is there something special on x86 that makes the shadow stack pte
> > > non-writable by the CPU?
> > >
> > 
> > Some of the context is here:
> > https://lore.kernel.org/all/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/
> > 
> > We had a similar issue with migration, but this should handle the DMA
> > case as well.
> > 
> > It's "technically writable" but the kernel is supposed to prevent that.
> 
> Bah, it's not writable at all. The CPU PTE has write disabled and
> someone thought it was a good idea to make pte_write() return true
> because the CPU allows writes through a special instruction on this
> special PTE? So now all the places like this think its writable, when
> it really isn't.
>

I completely missed this, that will teach me to trust pte_write() I
guess... what a bizarre design choice.  I'm sure there's "reasons".

> You could also fix this by having something like pte_real_write() or
> whatever that doesn't lie about the write bit in the PTE :|
> 

or rename pte_write() to pte_fake_write() instead and restore
pte_write() to its former truthful glory

:| indeed

> The patch is still fine, in that it matches what everything else does,
> but I'd include these details someplace..
> 

Thank you for taking a closer look, I think Andrew's changelog
adjustment is an improvement if you're ok with it.

-- 
~Gregory

Re: [PATCH] mm/hmm: reject shadow-stack mappings

[David Hildenbrand (Arm)]

On 11/14/26 08:25, Gregory Price (Meta) wrote:
> On 2026-11-13 20:20 -0400, Jason Gunthorpe wrote:
>> On Fri, Nov 13, 2026 at 03:41:33PM -0500, Gregory Price (Meta) wrote:
>>>
>>> Some of the context is here:
>>> https://lore.kernel.org/all/20261111-mason-migrate-et-al-fixes-v1-10-3d2454362e8d@kernel.org/
>>>
>>> We had a similar issue with migration, but this should handle the DMA
>>> case as well.
>>>
>>> It's "technically writable" but the kernel is supposed to prevent that.
>>
>> Bah, it's not writable at all. The CPU PTE has write disabled and
>> someone thought it was a good idea to make pte_write() return true
>> because the CPU allows writes through a special instruction on this
>> special PTE? So now all the places like this think its writable, when
>> it really isn't.
>>
> 
> I completely missed this, that will teach me to trust pte_write() I
> guess... what a bizarre design choice.  I'm sure there's "reasons".
> 
>> You could also fix this by having something like pte_real_write() or
>> whatever that doesn't lie about the write bit in the PTE :|
>>
> 
> or rename pte_write() to pte_fake_write() instead and restore
> pte_write() to its former truthful glory

It's writable by the hardware, that's what matters to core-mm, for example, when
it comes to things like fork(), mproetect() etc.

*nobody* besides selected core-mm code should ever write to random PTEs. They
shouldn't ever even care about pte_write().

We have GUP for that, which takes care of that oddity properly when deciding
whether we can *actually* write to a mapped page.

Well, and we have HMM that reimplements part of GUP in ugly ways (sorry) that we
missed.

-- 
Cheers,

David