Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: - [High] Exporting `set_direct_map_*_noflush` APIs without exporting `can_set_direct_map` forces loadable modules to silently fail to protect memory on ARM64, breaking security guarantees. --
commit 6a5f6422ed6de263b9c669919e175cc7d1ac6c09 Author: Thierry Reding <[email protected]> arm64/mm: Export set_direct_map_*_noflush() APIs Drivers that use this may want to be built as a module, so export them. > diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c > index 132938b32eb16..9253c529f8aa5 100644 > --- a/arch/arm64/mm/pageattr.c > +++ b/arch/arm64/mm/pageattr.c > @@ -262,6 +262,7 @@ int set_direct_map_invalid_noflush(struct page *page, > unsigned int numpages) > return update_range_prot((unsigned long)page_address(page), > PAGE_SIZE * numpages, set_mask, clear_mask); > } > +EXPORT_SYMBOL(set_direct_map_invalid_noflush); [Severity: High] Are loadable modules going to silently fail to protect memory when using this exported API? If the kernel boots with a configuration where can_set_direct_map() is false (e.g., rodata_full and debug_pagealloc are disabled), set_direct_map_invalid_noflush() returns 0 without modifying the page tables: arch/arm64/mm/pageattr.c:set_direct_map_invalid_noflush() { ... if (!can_set_direct_map()) return 0; ... } Because can_set_direct_map() is not exported, a module cannot check this capability itself. The module will receive 0 (success) and mistakenly assume the memory was successfully isolated. For security features, this means content-protected memory remains accessible in the kernel's linear mapping. This can break DRM guarantees by allowing the CPU to read protected memory, or cause a kernel panic if the hardware enforces protection but the CPU speculatively accesses the region via stale linear map PTEs. > > int set_direct_map_default_noflush(struct page *page, unsigned int numpages) > { > @@ -274,6 +275,7 @@ int set_direct_map_default_noflush(struct page *page, > unsigned int numpages) > return update_range_prot((unsigned long)page_address(page), > PAGE_SIZE * numpages, set_mask, clear_mask); > } > +EXPORT_SYMBOL(set_direct_map_default_noflush); [Severity: High] Does this apply the same silent failure logic when a module attempts to restore the mapping? -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=4
