From nobody Sat Jul 25 05:35:10 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 851B33DD533 for ; Fri, 17 Jul 2026 09:41:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784281313; cv=none; b=G9XncYx5R/qQXEIy2oy2elQ/zuXYVBWZ7IAk9tlQ+3vZufY9yqzDjK6ULyDyORXwpsVe8qbGYO0w7qeIHs68qLVcntcuOipqbpahgLefhqu3vXvC16PP6+4ThL3Kass5q38oY+pqstF+6bL0v5+yV6/rWQ5tr56hECGc/Acaddc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784281313; c=relaxed/simple; bh=TuIfTCCmJRP0YIwZkmbwL8OuJbQWkLwVGTxmQltgWhA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=oybWNS49rIKrNH3asGQbDLTzz21EntSM4htba6zzELriW//PrEyNCH/c/2kiTykK5ZgoH26vzANoeuuqnKjtY9bdFwvJiWF/UgTWnLWkkNdjDVK3mQ2yE7ChmNmIR7V94uPv3YzdL6ouaAl8svj4M8m1pWZZ/Wc/VTGZG/DYZko= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=hu9f16IL; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="hu9f16IL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC0761F00A3A; Fri, 17 Jul 2026 09:41:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1784281309; bh=JFxLOoGKZJ9NbVlJTIbnhsfOBq5K5fiTuVJF/8xrLTM=; h=From:Date:Subject:To:Cc; b=hu9f16ILAeeO4JYJbK9HEYguo3K0RBxbxg79BYtnA+OLgNGH1cvnxzeNGSt6dCYU8 Iq306COoduFPIZ1JB+BTymWOwcVkFCCcIXc2ukUO2HM3legFFVeTeF5Toe1c6gDcVt JxV7mN90uR3OyY122ir0CZWjURq27H7RFX5MwjIWQD58zn1jLuwwCzG7jMveWRaail vR+BVFJQjPv6T+PJC1hNjN82EqPEVlp8gCTRU0jG945wepVIQ+69zGEOzyGX3Bfys4 wHHGNGlaujG4tQwH9r/TirtgHjIrMxiSVfW8vSHvGryHtGENl+V0sPGgtQYv2UmpR7 ROwA78/gDJI5A== From: "Mike Rapoport (Microsoft)" Date: Fri, 17 Jul 2026 12:41:43 +0300 Subject: [PATCH v2] x86/mm/pat: fix effective RW computation in lookup_address_in_pgd_attr() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260717-verify-rwx-fix-v2-1-fc23141311d6@kernel.org> X-B4-Tracking: v=1; b=H4sIANb4WWoC/3WO3RKCIBBGX8XhOgqQzOmq92i8AFmVfqBZjHQc3 z2w6y7Pt9+e3YUEQAuBnIuFIEQbrHcJxK4g7aBcD9SaxEQwUbETr2hM/W6m+JloZydaaqZNCUc upCRp6YWQ4k14bX4c3voG7ZgtuaFVAKpRuXbIkUfbW3d4qjAC5vlgw+hx3j6KPHv+Ho+ccmpqx WR9lKZj1eUO6OCx99iTZl3XL4WZ7yvfAAAA X-Change-ID: 20260716-verify-rwx-fix-3b0bd3e51244 To: Dave Hansen Cc: Andy Lutomirski , Borislav Petkov , David Laight , Ingo Molnar , Ingo Molnar , Juergen Gross , "Mike Rapoport (Microsoft)" , "H. Peter Anvin" , Peter Zijlstra , Thomas Gleixner , x86@kernel.org, linux-kernel@vger.kernel.org X-Mailer: b4 0.16-dev lookup_address_in_pgd_attr() accumulates the effective NX and RW bits of the walked page table levels so that verify_rwx() can detect mappings that are both writable and executable. The RW bits are folded into a bool with rw &=3D pXd_flags(*pXd) & _PAGE_RW; but _PAGE_RW is 0x2. So consider the accumulation line: rw &=3D pXd_flags(*pXd) & _PAGE_RW; where rw=3D0x1 and the right side evaluates down to 0x2. It'll end up doing: rw =3D 0x1 & 0x2 and rw always ends up 0. This way rw becomes false at the first level walked, regardless of the actual permissions, and verify_rwx() treats every mapping as non-writable and never reports a W^X violation. Add double negation to the right side to normalize the _PAGE_RW flag to 0 or 1. Fixes: ceb647b4b529 ("x86/pat: Introduce lookup_address_in_pgd_attr()") Assisted-by: Copilot:claude-opus-4.8 Signed-off-by: Mike Rapoport (Microsoft) Reviewed-by: Juergen Gross --- v2 changes: * use a simpler version that uses !! to ensure the comparison result is 0 or 1 v1: https://patch.msgid.link/20260716-verify-rwx-fix-v1-1-d8a04854df06@kern= el.org --- arch/x86/mm/pat/set_memory.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c index d023a40a1e03..cd9ecc8e52f9 100644 --- a/arch/x86/mm/pat/set_memory.c +++ b/arch/x86/mm/pat/set_memory.c @@ -731,7 +731,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned = long address, =20 *level =3D PG_LEVEL_512G; *nx |=3D pgd_flags(*pgd) & _PAGE_NX; - *rw &=3D pgd_flags(*pgd) & _PAGE_RW; + *rw &=3D !!(pgd_flags(*pgd) & _PAGE_RW); =20 p4d =3D p4d_offset(pgd, address); if (p4d_none(*p4d)) @@ -742,7 +742,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned = long address, =20 *level =3D PG_LEVEL_1G; *nx |=3D p4d_flags(*p4d) & _PAGE_NX; - *rw &=3D p4d_flags(*p4d) & _PAGE_RW; + *rw &=3D !!(p4d_flags(*p4d) & _PAGE_RW); =20 pud =3D pud_offset(p4d, address); if (pud_none(*pud)) @@ -753,7 +753,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned = long address, =20 *level =3D PG_LEVEL_2M; *nx |=3D pud_flags(*pud) & _PAGE_NX; - *rw &=3D pud_flags(*pud) & _PAGE_RW; + *rw &=3D !!(pud_flags(*pud) & _PAGE_RW); =20 pmd =3D pmd_offset(pud, address); if (pmd_none(*pmd)) @@ -764,7 +764,7 @@ pte_t *lookup_address_in_pgd_attr(pgd_t *pgd, unsigned = long address, =20 *level =3D PG_LEVEL_4K; *nx |=3D pmd_flags(*pmd) & _PAGE_NX; - *rw &=3D pmd_flags(*pmd) & _PAGE_RW; + *rw &=3D !!(pmd_flags(*pmd) & _PAGE_RW); =20 return pte_offset_kernel(pmd, address); } --- base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa change-id: 20260716-verify-rwx-fix-3b0bd3e51244 -- Sincerely yours, Mike.