Re: [PATCH V4 3/4] arm64/mm: Use p4dp_get() for P4D accesses

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] arm64/mm: early boot KASAN fault in out-of-line pud_offset_phys()
--

commit eaa67607aabb8af35fe6970c5442e1ab262f0286
Author: Anshuman Khandual <anshuman.khandual@arm.com>

arm64/mm: Use p4dp_get() for P4D accesses

This commit replaces READ_ONCE() with p4dp_get() for P4D accesses across
arm64/mm and moves pud_offset_phys() and pud_offset() out of
arch/arm64/include/asm/pgtable.h into arch/arm64/mm/mmu.c to avoid header
dependency cycles.

> diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c
> index afa15b1a8a247..5b5a85a0527d6 100644
> --- a/arch/arm64/mm/mmu.c
> +++ b/arch/arm64/mm/mmu.c

[ ... ]

> @@ -2449,3 +2449,17 @@ bool pmdp_test_and_clear_young(struct vm_area_struct *vma, unsigned long address
>  	return __ptep_test_and_clear_young(vma, address, (pte_t *)pmdp);
>  }
>  #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_ARCH_HAS_NONLEAF_PMD_YOUNG */
> +
> +#if CONFIG_PGTABLE_LEVELS > 3
> +phys_addr_t pud_offset_phys(p4d_t *p4dp, unsigned long addr)
> +{
> +	VM_WARN_ON_ONCE(!pgtable_l4_enabled());
> +
> +	return p4d_page_paddr(p4dp_get(p4dp)) + pud_index(addr) * sizeof(pud_t);
> +}

[Severity: High]
Does moving pud_offset_phys() out-of-line into arch/arm64/mm/mmu.c without
noinstr or __no_sanitize_address cause an early boot translation fault when
CONFIG_KASAN_GENERIC or CONFIG_KASAN_SW_TAGS is enabled with 4-level or
5-level page tables?

During early boot before start_kernel(), __primary_switched calls
kasan_early_init() in arch/arm64/mm/kasan_init.c to populate the initial
early KASAN shadow page tables:

  __primary_switched
    -> kasan_early_init()
      -> kasan_pgd_populate(..., true)
        -> kasan_p4d_populate(..., true)
          -> kasan_pud_populate(..., true)
            -> kasan_pud_offset(p4dp, addr, node, true)
              -> pud_offset_kimg(p4dp, addr)
                -> pud_offset_phys(p4dp, addr)

At that point, no KASAN shadow PTEs have been mapped yet, which is why
arch/arm64/mm/Makefile sets:

  KASAN_SANITIZE_kasan_init.o := n

Previously, pud_offset_phys() was a static inline helper in
arch/arm64/include/asm/pgtable.h, so it was inlined into kasan_init.o
without KASAN instrumentation.

With pud_offset_phys() moved into arch/arm64/mm/mmu.c, which is compiled with
KASAN sanitization enabled, calling pud_offset_phys() from kasan_early_init()
triggers KASAN shadow memory checks on p4dp before the early shadow memory
is mapped.

Should pud_offset_phys() be marked noinstr (like set_swapper_pgd() in the
same file) or __no_sanitize_address?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261105043403.3326445-1-anshuman.khandual@arm.com?part=3