From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 77EBEC982EE for ; Mon, 21 Sep 2026 10:59:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:Cc:To:In-Reply-To:References:Message-Id :MIME-Version:Subject:Date:From:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=jsw199OBBZ3mWtOm/hj+7g2BjJI/a42qxGpRBsqq2f8=; b=WRc1yywvABSeL9 IkNFTN4V80o7Qyup2J31x7n+38Tpz9v92d28HUz+C8ubFkLRhbTM4YF04wtZ49keirEiACkQluH1b sMmEbjwjbepU2u/GLhgbE5kepxMNFs/O7ODXVPIf8SBpJpkte2goWwz7m1dqnMU2rknJXMt7bJndu gHyf+Gkd0Ue/gki8ww4mrp1pFcp/6JPNv649T5FIMckhV0NyKFan4PuLeCHh2tiLytt9TfDlo3+6T VtGyFJ2xVnsI8VY0CWbUljVh8idBkjJe4TBKJvC4pJunbAiaQmHuFUQHIH1+5fJUTM2HwZ6Rs4Ka9 6YRWSSq84Rkp9wyC8ung==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1x8bji-00000001nSk-1NoN; Mon, 21 Sep 2026 10:59:02 +0000 Received: from casper.infradead.org ([2001:8b0:10b:1236::1]) by bombadil.infradead.org with esmtps (Exim 4.99.1 #2 (Red Hat Linux)) id 1x8bjW-00000001nGF-2nLc; Mon, 21 Sep 2026 10:58:52 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=Cc:To:In-Reply-To:References:Message-Id :Content-Transfer-Encoding:Content-Type:MIME-Version:Subject:Date:From:Sender :Reply-To:Content-ID:Content-Description; bh=uKK5tiF0Agsvoxq6PuilGLIE+2qkeMucLJBKKyIWDK0=; b=pkCfDZG46S0PDPkIMl2QdT7aHW DacqBnKN8nNJmHRJuhRXeTUTsIDQw9DqhgWZvx384J+1z00dKBMBjLRpWjzHq3+tU4M6WX9spY51x 5FOk0Jp7LLeChcU0j41pNQwUSEtduOo+PHJ893XKS0P+WfaU+fBzEUXbi1gryuz/PXz3DNnkvN+Ta ZFSLJ7LDU/Ri7hWpuNP5+a5l0Dc3hpCjZf9VBPJ0Lon8DhRBOaOn+6+BZ93pkcl6CqmM5uPH2HEUO jkP2deGZPikyV/bBnKkoLEe8zuzXFSFNqiNn3ifu8z3JQ4wXp2fd6Q8g6SkkXOpM3jG1tggI09ZWj h5YvH+bQ==; Received: from foss.arm.com ([217.140.110.172]) by casper.infradead.org with esmtp (Exim 4.99.1 #2 (Red Hat Linux)) id 1x8bjS-00000003RpL-0fRU; Mon, 21 Sep 2026 10:58:49 +0000 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 34A151D13; Mon, 21 Sep 2026 03:58:41 -0700 (PDT) Received: from e129823.arm.com (e129823.arm.com [10.2.213.3]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 97C853F86C; Mon, 21 Sep 2026 03:58:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=arm.com; s=foss; t=1789988324; bh=wV1Rko2jO3CBq2XkkZPZAq0K5FwAUXTua1cF3CtPA0Q=; h=From:Date:Subject:References:In-Reply-To:To:Cc:From; b=M69yt9JNZZOu07m2eMUXUE7kOouVrZ1x/HOoeFBr+noA27ltzymcz/8DIQ6+nWmeA Kl3YQM/RF8UVLyxHtt3QuNclLtl3PDdDABqDQoBAZLOMcsdrQA4rXueqGUmFuELMoB 9zMg9PMSynQbdAYiXfxLlCV+wg7YHxMgGrf3BDy8= From: Yeoreum Yun Date: Mon, 21 Sep 2026 11:55:40 +0100 Subject: [PATCH 18/21] mm/pgtable: catch abuse of folded dummy pgd_t/p4d_t/pud_t MIME-Version: 1.0 Message-Id: <20260921-dummy_ptxp3-v1-18-cd40cf68242e@arm.com> References: <20260921-dummy_ptxp3-v1-0-cd40cf68242e@arm.com> In-Reply-To: <20260921-dummy_ptxp3-v1-0-cd40cf68242e@arm.com> To: Russell King , Huacai Chen , WANG Xuerui , Thomas Bogendoerfer , Catalin Marinas , Will Deacon , Arnd Bergmann , Andrew Morton , Kairui Song , Qi Zheng , Shakeel Butt , Barry Song , Axel Rasmussen , Yuanchu Xie , Wei Xu , Johannes Weiner , David Hildenbrand , Michal Hocko , Lorenzo Stoakes , Tianrui Zhao , Bibo Mao , Anup Patel , Atish Patra , Paul Walmsley , Palmer Dabbelt , Albert Ou , Alexandre Ghiti , Dave Hansen , Andy Lutomirski , Peter Zijlstra , Thomas Gleixner , Ingo Molnar , Borislav Petkov , x86@kernel.org, "H. Peter Anvin" , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Jonas Bonn , Stefan Kristiansson , Stafford Horne Cc: linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, loongarch@lists.linux.dev, linux-mips@vger.kernel.org, linux-arch@vger.kernel.org, linux-mm@kvack.org, kvm@vger.kernel.org, kvm-riscv@lists.infradead.org, linux-riscv@lists.infradead.org, linux-openrisc@vger.kernel.org X-Mailer: b4 0.13.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5536; i=yeoreum.yun@arm.com; h=from:subject:message-id; bh=l+aFtD+gf169DFuCaai5cwdW0dtCP9VrudnD5mceiXU=; b=owEB7QES/pANAwAKAW3Vw9FaxTEzAcsmYgBqsQ1TVJ8WMEBMvMxpLmee8FhBXqTgwIAqkv6F1 pZhimntkJuJAbMEAAEKAB0WIQQtg+CS3QUzuFh1pJ1t1cPRWsUxMwUCarENUwAKCRBt1cPRWsUx M4WLC/sEXXfDYkutq+XAp2eq4pnDsW6DCLQnTbXxUpR54sRfzZL7IThTi7dm/8TREnCeAjQzxSb kIEls9cerKZbqCqvoo1jxqfAow3waQ7/FpfR3e0QBaKEGCVcOXbUkfZZWme1N1fIZs/5+T1FMM/ Wmno7S+8Qmijp4q76nSESjDriWdGU45ti1Gddg0VHaL4Ge1gjs2m8fjk8fQ2zm44AYbJF6QQype 07q+r9nZBtf283PQwCq+ujgtbmj0quciFUubtzKIEftdItMvCx4D6aFGlWt+xl7NNnjVXMIoIZM gt3foVK/bmLXFR9La90KMSAFxgXzS9YScthuZoL/8m5YdttG8nj+VUuQLBgZrXRgXiYwY74HCui x4bKpVVRItDotIL4T6torQgNsStmEkdDf8yASZ0OxkhEpIjSDLWHoD83ROEl9Vi5hatDNf6ua9t S2qYUC7sUdkPljmrhJZ3t7h+vrNE+C81GHrh7eq0o3aM1EqMeCg95MTIGsPmP+lkqMc+c= X-Developer-Key: i=yeoreum.yun@arm.com; a=openpgp; fpr=2D83E092DD0533B85875A49D6DD5C3D15AC53133 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.9.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20260921_115846_551352_EC7ACD2B X-CRM114-Status: GOOD ( 13.27 ) X-BeenThere: linux-riscv@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Sender: "linux-riscv" Errors-To: linux-riscv-bounces+linux-riscv=archiver.kernel.org@lists.infradead.org From: "David Hildenbrand (Arm)" Catch and prevent all abuse with dummy values on the stack similar to: pud_t pud = pudp_get(pudp); pmd_t *pmdp = pud_offset(*pud, addr); While this approach relies on the compiler propagating constants, it should catch most of the issues in practice. It would have caught all the issues were found through manual inspection. To avoid build issues particularly on x86, where pgd_val() might not be around in some inclusion paths, perform the new checks from wrapper macros. Signed-off-by: David Hildenbrand (Arm) --- include/asm-generic/pgtable-nop4d.h | 23 ++++++++++++++++++----- include/asm-generic/pgtable-nopmd.h | 24 ++++++++++++++++++------ include/asm-generic/pgtable-nopud.h | 24 ++++++++++++++++++------ 3 files changed, 54 insertions(+), 17 deletions(-) diff --git a/include/asm-generic/pgtable-nop4d.h b/include/asm-generic/pgtable-nop4d.h index acd62ee233536..2d86325235da5 100644 --- a/include/asm-generic/pgtable-nop4d.h +++ b/include/asm-generic/pgtable-nop4d.h @@ -34,7 +34,7 @@ static inline bool pgd_leaf(pgd_t pgd) { return false; } */ #define set_pgd(pgdptr, pgdval) set_p4d((p4d_t *)(pgdptr), (p4d_t) { pgdval }) -static inline pgd_t pgdp_get(pgd_t *pgdp) +static __always_inline pgd_t pgdp_get(pgd_t *pgdp) { pgd_t dummy = { 0 }; @@ -42,17 +42,30 @@ static inline pgd_t pgdp_get(pgd_t *pgdp) } #define pgdp_get pgdp_get -static inline p4d_t *p4d_offset(pgd_t *pgd, unsigned long address) +#define pgd_check_dummy(pgd) BUILD_BUG_ON(__builtin_constant_p(pgd_val(pgd))) + +static __always_inline p4d_t *__p4d_offset(pgd_t *pgdp, unsigned long address) { - return (p4d_t *)pgd; + return (p4d_t *)pgdp; } -static inline p4d_t *p4d_offset_lockless(pgd_t *pgdp, pgd_t pgd, +#define p4d_offset(pgdp, address) \ +({ \ + pgd_check_dummy(*(pgdp)); \ + __p4d_offset(pgdp, address); \ +}) + +static __always_inline p4d_t *__p4d_offset_lockless(pgd_t *pgdp, pgd_t pgd, unsigned long address) { return (p4d_t *)pgdp; } -#define p4d_offset_lockless p4d_offset_lockless + +#define p4d_offset_lockless(pgdp, pgd, address) \ +({ \ + pgd_check_dummy(*(pgdp)); \ + __p4d_offset_lockless(pgdp, pgd, address); \ +}) #define p4d_val(x) (pgd_val((x).pgd)) #define __p4d(x) ((p4d_t) { __pgd(x) }) diff --git a/include/asm-generic/pgtable-nopmd.h b/include/asm-generic/pgtable-nopmd.h index 9322f07ddf1ef..bd40d3a5743ff 100644 --- a/include/asm-generic/pgtable-nopmd.h +++ b/include/asm-generic/pgtable-nopmd.h @@ -43,7 +43,7 @@ static inline void pud_clear(pud_t *pud) { } */ #define set_pud(pudptr, pudval) set_pmd((pmd_t *)(pudptr), (pmd_t) { pudval }) -static inline pud_t pudp_get(pud_t *pudp) +static __always_inline pud_t pudp_get(pud_t *pudp) { pud_t dummy = { 0 }; @@ -51,18 +51,30 @@ static inline pud_t pudp_get(pud_t *pudp) } #define pudp_get pudp_get -static inline pmd_t * pmd_offset(pud_t * pud, unsigned long address) +#define pud_check_dummy(pud) BUILD_BUG_ON(__builtin_constant_p(pud_val(pud))) + +static __always_inline pmd_t *__pmd_offset(pud_t *pudp, unsigned long address) { - return (pmd_t *)pud; + return (pmd_t *)pudp; } -#define pmd_offset pmd_offset -static inline pmd_t *pmd_offset_lockless(pud_t *pudp, pud_t pud, +#define pmd_offset(pudp, address) \ +({ \ + pud_check_dummy(*(pudp)); \ + __pmd_offset(pudp, address); \ +}) + +static __always_inline pmd_t *__pmd_offset_lockless(pud_t *pudp, pud_t pud, unsigned long address) { return (pmd_t *)pudp; } -#define pmd_offset_lockless pmd_offset_lockless + +#define pmd_offset_lockless(pudp, pud, address) \ +({ \ + pud_check_dummy(*(pudp)); \ + __pmd_offset_lockless(pudp, pud, address); \ +}) #define pmd_val(x) (pud_val((x).pud)) #define __pmd(x) ((pmd_t) { __pud(x) } ) diff --git a/include/asm-generic/pgtable-nopud.h b/include/asm-generic/pgtable-nopud.h index 8f01abbb00503..7475d0bd0f2e0 100644 --- a/include/asm-generic/pgtable-nopud.h +++ b/include/asm-generic/pgtable-nopud.h @@ -41,7 +41,7 @@ static inline bool p4d_leaf(p4d_t p4d) { return false; } */ #define set_p4d(p4dptr, p4dval) set_pud((pud_t *)(p4dptr), (pud_t) { p4dval }) -static inline p4d_t p4dp_get(p4d_t *p4dp) +static __always_inline p4d_t p4dp_get(p4d_t *p4dp) { p4d_t dummy = { 0 }; @@ -49,18 +49,30 @@ static inline p4d_t p4dp_get(p4d_t *p4dp) } #define p4dp_get p4dp_get -static inline pud_t *pud_offset(p4d_t *p4d, unsigned long address) +#define p4d_check_dummy(p4d) BUILD_BUG_ON(__builtin_constant_p(p4d_val(p4d))) + +static __always_inline pud_t *__pud_offset(p4d_t *p4dp, unsigned long address) { - return (pud_t *)p4d; + return (pud_t *)p4dp; } -#define pud_offset pud_offset -static inline pud_t *pud_offset_lockless(p4d_t *p4dp, p4d_t p4d, +#define pud_offset(p4dp, address) \ +({ \ + p4d_check_dummy(*(p4dp)); \ + __pud_offset(p4dp, address); \ +}) + +static __always_inline pud_t *__pud_offset_lockless(p4d_t *p4dp, p4d_t p4d, unsigned long address) { return (pud_t *)p4dp; } -#define pud_offset_lockless pud_offset_lockless + +#define pud_offset_lockless(p4dp, p4d, address) \ +({ \ + p4d_check_dummy(*(p4dp)); \ + __pud_offset_lockless(p4dp, p4d, address); \ +}) #define pud_val(x) (p4d_val((x).p4d)) #define __pud(x) ((pud_t) { __p4d(x) }) -- 2.43.0 _______________________________________________ linux-riscv mailing list linux-riscv@lists.infradead.org http://lists.infradead.org/mailman/listinfo/linux-riscv