Re: [PATCH] x86/mm/pat: fix effective RW computation in lookup_address_in_pgd_attr()

["Jürgen Groß" <jgross@suse.com>]

[-- Attachment #1.1.1: Type: text/plain, Size: 1234 bytes --]

On 16.07.26 10:10, Mike Rapoport (Microsoft) wrote:
> lookup_address_in_pgd_attr() accumulates the effective NX and RW bits of
> the walked page table levels so that verify_rwx() can detect mappings that
> are both writable and executable.
> 
> The RW bits are folded into a bool with
> 
> 	*rw &= pXd_flags(*pXd) & _PAGE_RW;
> 
> but _PAGE_RW is bit 1 while *rw only ever holds 0 or 1, so the AND is
> always 0.  *rw becomes false at the first level walked, regardless of the
> actual permissions, and verify_rwx() treats every mapping as non-writable
> and never reports a W^X violation.
> 
> Accumulate NX and RW in unsigned long locals in their native bit positions
> and store the result into the bool outputs once.
> 
> Fixes: ceb647b4b529 ("x86/pat: Introduce lookup_address_in_pgd_attr()")
> Assisted-by: Copilot:claude-opus-4.8
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

Thanks for catching this.

Reviewed-by: Juergen Gross <jgross@suse.com>

Just one remark: instead of using additional local variables the fix could
just look like:

     *rw |= !!(pXd_flags(*pXd) & _PAGE_RW);

I don't really care how the issue is fixed, but this would result in less
code.


Juergen

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 3743 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 495 bytes --]