[PATCH stable 5.10.y-6.12.y] arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings

[PATCH stable 5.10.y-6.12.y] arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings

[Catalin Marinas]

PROT_MTE (memory tagging extensions) is not supported on all user mmap()
types for various reasons (memory attributes, backing storage, CoW
handling). The arm64 arch_validate_flags() function checks whether the
VM_MTE_ALLOWED flag has been set for a vma during mmap(), usually by
arch_calc_vm_flag_bits().

Linux prior to 6.13 does not support PROT_MTE hugetlb mappings. This was
added by commit 25c17c4b55de ("hugetlb: arm64: add mte support").
However, earlier kernels inadvertently set VM_MTE_ALLOWED on
(MAP_ANONYMOUS | MAP_HUGETLB) mappings by only checking for
MAP_ANONYMOUS.

Explicitly check MAP_HUGETLB in arch_calc_vm_flag_bits() and avoid
setting VM_MTE_ALLOWED for such mappings.

Fixes: 9f3419315f3c ("arm64: mte: Add PROT_MTE support to mmap() and mprotect()")
Cc: <stable@vger.kernel.org> # 5.10.x-6.12.x
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
---

Hi Greg,

This patch applies cleanly on top of the stable-rc/linux-6.12.y to
5.10.y LTS, so I'm only sending it once. It's not for 6.13 onwards since
those kernels support hugetlbfs with MTE.

Thanks,

Catalin

 arch/arm64/include/asm/mman.h | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/include/asm/mman.h b/arch/arm64/include/asm/mman.h
index 798d965760d4..5a280ac7570c 100644
--- a/arch/arm64/include/asm/mman.h
+++ b/arch/arm64/include/asm/mman.h
@@ -41,9 +41,12 @@ static inline unsigned long arch_calc_vm_flag_bits(struct file *file,
 	 * backed by tags-capable memory. The vm_flags may be overridden by a
 	 * filesystem supporting MTE (RAM-based).
 	 */
-	if (system_supports_mte() &&
-	    ((flags & MAP_ANONYMOUS) || shmem_file(file)))
-		return VM_MTE_ALLOWED;
+	if (system_supports_mte()) {
+		if ((flags & MAP_ANONYMOUS) && !(flags & MAP_HUGETLB))
+			return VM_MTE_ALLOWED;
+		if (shmem_file(file))
+			return VM_MTE_ALLOWED;
+	}
 
 	return 0;
 }

Re: [PATCH stable 5.10.y-6.12.y] arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings

[Greg Kroah-Hartman]

On Thu, Feb 20, 2025 at 03:58:01PM +0000, Catalin Marinas wrote:
> PROT_MTE (memory tagging extensions) is not supported on all user mmap()
> types for various reasons (memory attributes, backing storage, CoW
> handling). The arm64 arch_validate_flags() function checks whether the
> VM_MTE_ALLOWED flag has been set for a vma during mmap(), usually by
> arch_calc_vm_flag_bits().
> 
> Linux prior to 6.13 does not support PROT_MTE hugetlb mappings. This was
> added by commit 25c17c4b55de ("hugetlb: arm64: add mte support").
> However, earlier kernels inadvertently set VM_MTE_ALLOWED on
> (MAP_ANONYMOUS | MAP_HUGETLB) mappings by only checking for
> MAP_ANONYMOUS.
> 
> Explicitly check MAP_HUGETLB in arch_calc_vm_flag_bits() and avoid
> setting VM_MTE_ALLOWED for such mappings.
> 
> Fixes: 9f3419315f3c ("arm64: mte: Add PROT_MTE support to mmap() and mprotect()")
> Cc: <stable@vger.kernel.org> # 5.10.x-6.12.x
> Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> ---
> 
> Hi Greg,
> 
> This patch applies cleanly on top of the stable-rc/linux-6.12.y to
> 5.10.y LTS, so I'm only sending it once. It's not for 6.13 onwards since
> those kernels support hugetlbfs with MTE.

Thanks for this, I'll queue it up after the next round of releases.

greg k-h

Re: [PATCH stable 5.10.y-6.12.y] arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings

[Sasha Levin]

[ Sasha's backport helper bot ]

Hi,

Summary of potential issues:
⚠️ Could not find matching upstream commit

No upstream commit was identified. Using temporary commit for testing.

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-6.12.y       |  Success    |  Success   |
| stable/linux-5.10.y       |  Success    |  Success   |

Re: [PATCH stable 5.10.y-6.12.y] arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings

[Greg Kroah-Hartman]

On Thu, Feb 20, 2025 at 03:58:01PM +0000, Catalin Marinas wrote:
> PROT_MTE (memory tagging extensions) is not supported on all user mmap()
> types for various reasons (memory attributes, backing storage, CoW
> handling). The arm64 arch_validate_flags() function checks whether the
> VM_MTE_ALLOWED flag has been set for a vma during mmap(), usually by
> arch_calc_vm_flag_bits().
> 
> Linux prior to 6.13 does not support PROT_MTE hugetlb mappings. This was
> added by commit 25c17c4b55de ("hugetlb: arm64: add mte support").
> However, earlier kernels inadvertently set VM_MTE_ALLOWED on
> (MAP_ANONYMOUS | MAP_HUGETLB) mappings by only checking for
> MAP_ANONYMOUS.
> 
> Explicitly check MAP_HUGETLB in arch_calc_vm_flag_bits() and avoid
> setting VM_MTE_ALLOWED for such mappings.
> 
> Fixes: 9f3419315f3c ("arm64: mte: Add PROT_MTE support to mmap() and mprotect()")
> Cc: <stable@vger.kernel.org> # 5.10.x-6.12.x
> Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
> Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> ---
> 
> Hi Greg,
> 
> This patch applies cleanly on top of the stable-rc/linux-6.12.y to
> 5.10.y LTS, so I'm only sending it once. It's not for 6.13 onwards since
> those kernels support hugetlbfs with MTE.

Now queued up,t hanks.

greg k-h

Re: [PATCH stable 5.10.y-6.12.y] arm64: mte: Do not allow PROT_MTE on MAP_HUGETLB user mappings

[Catalin Marinas]

On Fri, Feb 21, 2025 at 04:17:09PM +0100, Greg Kroah-Hartman wrote:
> On Thu, Feb 20, 2025 at 03:58:01PM +0000, Catalin Marinas wrote:
> > PROT_MTE (memory tagging extensions) is not supported on all user mmap()
> > types for various reasons (memory attributes, backing storage, CoW
> > handling). The arm64 arch_validate_flags() function checks whether the
> > VM_MTE_ALLOWED flag has been set for a vma during mmap(), usually by
> > arch_calc_vm_flag_bits().
> > 
> > Linux prior to 6.13 does not support PROT_MTE hugetlb mappings. This was
> > added by commit 25c17c4b55de ("hugetlb: arm64: add mte support").
> > However, earlier kernels inadvertently set VM_MTE_ALLOWED on
> > (MAP_ANONYMOUS | MAP_HUGETLB) mappings by only checking for
> > MAP_ANONYMOUS.
> > 
> > Explicitly check MAP_HUGETLB in arch_calc_vm_flag_bits() and avoid
> > setting VM_MTE_ALLOWED for such mappings.
> > 
> > Fixes: 9f3419315f3c ("arm64: mte: Add PROT_MTE support to mmap() and mprotect()")
> > Cc: <stable@vger.kernel.org> # 5.10.x-6.12.x
> > Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
> > Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
> > ---
> > 
> > Hi Greg,
> > 
> > This patch applies cleanly on top of the stable-rc/linux-6.12.y to
> > 5.10.y LTS, so I'm only sending it once. It's not for 6.13 onwards since
> > those kernels support hugetlbfs with MTE.
> 
> Now queued up, thanks.

Thanks Greg.

-- 
Catalin