Hi,
On 8/22/26 4:07 PM, Stephano Cetola wrote:
> arch_remap_range() reassigned map_type via
> arm_mmu_maybe_skip_permissions() before checking
> maptype_is_compatible(map_type, MAP_CACHED) to decide whether to
> flush. arm_mmu_maybe_skip_permissions() can turn MAP_CACHED into
> MAP_CACHED_RWX, so the compatibility check ran against the
> already-stripped value instead of the caller's original request. A
> plain cached remap could silently skip the cache flush whenever
> permission-skipping is active, because MAP_CACHED_RWX no longer
> compares equal to MAP_CACHED.
>
> Fix: evaluate the flush gate against the original map_type first,
> then strip permissions afterward, right before the actual remap
> call.
>
> Found by code inspection while auditing map_type handling in this
> area. No incorrect behavior has been observed in practice. This is
> a correctness fix. It is not a report of an observed failure.
>
> Fixes: 317aff483607 ("ARM: mmu: introduce new maptype_t type")
> Signed-off-by: Stephano Cetola <[email protected]>
This now aligns mmu_64.c with what mmu_32.c was doing:
Reviewed-by: Ahmad Fatoum <[email protected]>
Cheers,
Ahmad
> ---
> arch/arm/cpu/mmu_64.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
>
> diff --git a/arch/arm/cpu/mmu_64.c b/arch/arm/cpu/mmu_64.c
> index 7f38473079..bf44cc7bcc 100644
> --- a/arch/arm/cpu/mmu_64.c
> +++ b/arch/arm/cpu/mmu_64.c
> @@ -286,11 +286,16 @@ static void early_remap_range(uint64_t addr, size_t
> size, maptype_t map_type)
>
> int arch_remap_range(void *virt_addr, phys_addr_t phys_addr, size_t size,
> maptype_t map_type)
> {
> - map_type = arm_mmu_maybe_skip_permissions(map_type);
> -
> + /*
> + * Check against the original map_type: permission-stripping below
> + * can turn MAP_CACHED into MAP_CACHED_RWX, which would look
> + * incompatible.
> + */
> if (!maptype_is_compatible(map_type, MAP_CACHED))
> flush_cacheable_pages(virt_addr, size);
>
> + map_type = arm_mmu_maybe_skip_permissions(map_type);
> +
> return __arch_remap_range((uint64_t)virt_addr, phys_addr,
> (uint64_t)size, map_type, true);
> }
>
>
> ---
> base-commit: 9bc1a26592a59919d2ee8c60c273d87d3d9f2e81
> change-id: 20260821-send-mmu-remap-order-ffa79f8f3847
>
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
