Re: [PATCH RFC v10 22/22] mm: Add basic tests for kpkeys_hardened_pgtables

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] mm: missing folded PUD and PMD checks in
  kpkeys_hardened_pgtables KUnit tests
--

commit 2fe47b9a3fc12c652abdd8342ffe143ffdaeb477
Author: Kevin Brodsky <kevin.brodsky@arm.com>

mm: Add basic tests for kpkeys_hardened_pgtables

This commit adds built-in KUnit tests for kpkeys_hardened_pgtables that
verify direct writes to kernel and user page table entries fail with
-EFAULT.

> diff --git a/mm/tests/kpkeys_hardened_pgtables_kunit.c b/mm/tests/kpkeys_hardened_pgtables_kunit.c
> new file mode 100644
> index 0000000000000..b6e1eba0d9b99
> --- /dev/null
> +++ b/mm/tests/kpkeys_hardened_pgtables_kunit.c
[ ... ]
> +	p4dp = p4d_offset(pgdp, addr);
> +	KUNIT_ASSERT_NOT_NULL_MSG(test, p4dp, "Failed to get P4D");
> +	if (!mm_p4d_folded(&init_mm))
> +		write_pgtable(p4d, p4dp);
> +
> +	pudp = pud_offset(p4dp, addr);
> +	KUNIT_ASSERT_NOT_NULL_MSG(test, pudp, "Failed to get PUD");
> +	if (!mm_pud_folded(&init_mm))
> +		write_pgtable(pud, pudp);
> +
> +	pmdp = pmd_offset(pudp, addr);
> +	KUNIT_ASSERT_NOT_NULL_MSG(test, pmdp, "Failed to get PMD");
> +	write_pgtable(pmd, pmdp);
> +
> +	ptep = pte_offset_kernel(pmdp, addr);
> +	KUNIT_ASSERT_NOT_NULL_MSG(test, ptep, "Failed to get PTE");
> +	write_pgtable(pte, ptep);
> +}
> +
> +/* Worth checking since the kernel image is mapped with static page tables */
> +static void write_kernel_image_pud(struct kunit *test)
> +{
> +	pud_t *pudp;
> +
> +	if (!kpkeys_supported())
> +		kunit_skip(test, "kpkeys are not supported");
> +
> +	/* The kernel is probably block-mapped, check the PUD to be safe */
> +	pudp = pud_off_k((unsigned long)&init_mm);
> +	KUNIT_ASSERT_NOT_NULL_MSG(test, pudp, "Failed to get PUD");
> +
> +	write_pgtable(pud, pudp);
> +}

[Severity: Medium]
Will write_kernel_image_pud() fail on configurations where the PUD level is
folded (such as 3-level page tables on arm64, or 16K pages with 52-bit VA
without FEAT_LPA2)?

When mm_pud_folded(&init_mm) is true, pud_off_k() resolves to an entry in
swapper_pg_dir, which is not protected by kpkeys_hardened_pgtables and is
still writable when built-in KUnit tests run before mark_rodata_ro(), so
copy_to_kernel_nofault() succeeds instead of returning -EFAULT.

Similarly, on 2-level page table configurations where mm_pmd_folded() is
true, the unguarded PMD writes in write_direct_map_pgtables() and
write_vmemmap_pmd() resolve into swapper_pg_dir, and pmd_off() in
write_user_pmd() resolves into current->mm->pgd (which is slab-allocated
from pgd_cache rather than kpkeys_pgtable_alloc() when PGD_SIZE !=
PAGE_SIZE).

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109-kpkeys-v10-0-aa6c4d9603bc@arm.com?part=22